What is the best way to secure a web server - Apache or Nginx?

Question

Java

Let's say there is a java webapp on the Tomcat server.
I want to set up DoS protection, a filter for valid http requests, limits on connections from one IP, and other methods of protection.

What would you recommend in this case - Apache or Nginx?

Answer 1

Using Apache as a protection against high loads is like allocating money to fight corruption.

Answer 2

Nginx unequivocally

Answer 3

Install Apache and Jinx Front.
run nGinx under:
http {
# even regular slow clients are usually expensive
reset_timedout_connection on;
client_header_timeout 15;
client_body_timeout 15;
send_timeout 5;
keepalive_timeout 30 15;
# introduce two restricted zones.
# On open connections and on request rate
limit_req_zone $binary_remote_addr zone=qglob:16m rate=3r/s;
limit_zone cglob $binary_remote_addr 16m;
server {
listen 80;
server_name www.myhost.ru;
proxy_set_header Host $host;
# needed for proxy_store to work
proxy_buffering on;
# limit the maximum number of connections from one ip
# to 4 clients from one ip via rfc2616
limit_conn cglob 32;
# Quickly catch "GET / ".
# Add a convenient file name.
location = / {
rewrite ^/$ /index.html last;
}
#Post-rate to serve static index.html or load from backend.
location = /index.html {
internal;
limit_req zone=qglob burst=9 nodelay;
open_file_cache_errors off;
root /tmp/nginx/cache/;
error_page 404 = /cached$uri;
}
location /cached/ {
internal;
alias /tmp/nginx/cache/;
proxy_pass phpfarm;
proxy_store on;
proxy_store_access user:rw group:rw all:r;
proxy_temp_path /tmp/nginx/tmp/;
}
#Brutally clamped on two requests per second search.
location = /advanced_search_result.php {
limit_req zone=qulag burst=2;
proxy_pass phpfarm;
}
# And everything else.
location / {
proxy_pass phpfarm;
}
}
}
You can also smoke in the direction of sysctl and pf (ipfw)

Answer 4

Other protection methods include hiding the version of nginx and PHP.
server_tokens off;in nginx.conf
expose_php = Offin php.ini

Answer 5

And what OS?

Answer 6

If I understand correctly, the author means the Apache WAF - mod_security. Protecting them from DDoS will not work, this is a slightly different thing, but you can easily make a filter for valid http requests. Nginx will save you from light pioneer DDoS, simply because of its architecture, but it is not able to carry out any checks for the validity or harmfulness of requests .

Answer 7

nginx + lua-nginx-module, a month ago there was an article on this topic on Habré: habrahabr.ru/blogs/nginx/130861/