Web Servers : Apache Web server, IIS

What is a WebServer?

Now let us know what is a web server, it is software that serves websites on the internet, and to achieve a particular goal it acts as a middleman between the server and the client. Servers are huge computers that store large amounts of data and are accessible by many users at a time. Web servers store, process, and provide the web pages that are requested by the user. E.g.: A user has a computer connected to the internet, and types www.h2kinfosys.com in a web browser like Internet Explorer, firefox, chrome, etc. The web server takes the request and processes it by displaying the web page of h2kinfosys.com.

For huge software, the organization can have its web servers, which are maintained by their IT team or the task is given to some IT company. For simple web applications, e.g. a marketing website of a small business, third-party web server services can be purchased. We consider two examples of web servers: Apache Webserver, and IIS.

Apache Web servers:

It is an open source of free software which powers many websites. Its official name is Apache HTTP Server which is maintained by Apache Foundation. Its main job is serving the website owners and the content of the websites. It is a very old and reliable web server. 

As we call Apache webserver, it is not a physical server but rather software that runs on a server. Its job is to create a connection between the server and the browsers when visitors visit the websites while delivering files back and forth. Apache is customizable software. As it has a module-based structure, these allow server administrators to turn additional functionalities on/off. Apache has various modules which include security modules, caching, URL re-writing, password authentication, and more.

Some common features in Apache include .htaccess, IPV6, FTP, HTTP/2, Perl/Lua, WebDav, Load balancing, URL rewriting, and session tracking. An Apache web server can host multiple websites on the same server without separating the server machine and Apache software for each website. This concept is called a Virtual Host or VHost.

There are two types of Apache Virtual Host:

1. Name-Based Virtual – Host

2. Address-based Virtual – Host

Name-Based Virtual Host

Definition: A Name-Based Virtual Host allows multiple websites to be hosted on a single IP address by distinguishing between them based on the domain name used in the HTTP request. When a user types a domain name in their browser, the web server identifies which site to serve based on the “Host” header in the request.

How It Works:

• The web server listens on a single IP address and port (usually port 80 for HTTP or port 443 for HTTPS).
• When a request is made, the server checks the “Host” header of the incoming request to determine which website the user wants to access.
• The server then directs the request to the appropriate directory or configuration for that domain.

Advantages:

• Cost-Effective: Multiple websites can be hosted on a single IP address, reducing costs associated with additional IP addresses.
• Easy Configuration: Simple to set up and manage, especially for hosting multiple small to medium-sized websites.
• Efficient Use of Resources: Saves IP addresses, which are becoming increasingly limited, especially in IPv4 environments.

Disadvantages:

• SSL/TLS Limitations: Traditionally, it was challenging to use SSL certificates with name-based virtual hosts because the server couldn’t determine which certificate to serve before reading the “Host” header. However, this has been largely resolved with the introduction of Server Name Indication (SNI).
• Compatibility Issues: Older clients or servers that do not support SNI may face issues with name-based virtual hosts over HTTPS.

Address-Based Virtual Host (IP-Based Virtual Host)

Definition: An Address-Based Virtual Host, also known as an IP-Based Virtual Host, assigns a unique IP address to each website hosted on a server. The server uses the IP address to determine which website to serve when a request is received.

How It Works:

• Each website is assigned a different IP address.
• The web server listens on multiple IP addresses and uses the destination IP of the incoming request to identify the correct site to serve.
• Unlike name-based virtual hosts, the server does not need to rely on the “Host” header.

Advantages:

• Better SSL/TLS Support: Since each site has its IP address, SSL certificates can be easily configured for each site without the need for SNI, enhancing compatibility with older clients.
• Isolation: Provides better isolation between sites, which can be useful for security and management purposes, particularly in environments where different clients require separate IP addresses.

Disadvantages:

• Higher Cost: Requires multiple IP addresses, which can increase costs, especially with the limited availability of IPv4 addresses.
• Resource Intensive: Managing multiple IP addresses can be more complex and resource-intensive compared to name-based virtual hosting.

Comparison Summary:

• Name-Based Virtual Host:
  • Uses: Single IP address, multiple domain names.
  • Cost: Cost-effective, saves IP addresses.
  • SSL/TLS Support: Requires SNI for multiple SSL sites on the same IP.
  • Use Case: Ideal for hosting multiple websites on a single server without additional IP addresses.
• Address-Based Virtual Host:
  • Uses: Multiple IP addresses, each assigned to a unique domain.
  • Cost: More expensive due to additional IP requirements.
  • SSL/TLS Support: Easily supports SSL/TLS without SNI.
  • Use Case: Preferred when SSL compatibility is a priority or when strict site isolation is needed.

Both methods have their use cases, and the choice between them often depends on specific requirements such as cost, SSL/TLS needs, and IP availability.

IIS Web servers:

IIS means Internet Information Services, which runs on the Microsoft .Net platform on the Windows OS. While it is possible to run IIS on Linux and Macs using Mono, this is considered as unstable. The internet cannot survive without web servers. Web server is the process of hosting web applications. This allows to processing of messages that arrive through particular TCP ports. 

The two main processes of handling web requests are: either handled by a single thread or spawn a new thread for each request. The thread-per-request model that IIS uses will grab a thread from a thread pool for each request. 

IIS is rich in features. IIS is used to host ASP.Net web applications and static websites. It can also be used as an FTP Server and extended to host web applications built on different platforms.

There are many built-in authentication options such as Basic, ASP.Net, and Windows authentication. One of the key features of IIS is the application pool. An invaluable feature is remote management. IIS can be managed via the CLI using Power Shell. IIS works through various standard languages and protocols. HTML is to create different elements like text, buttons, image placements, direct interactions, and hyperlinks. Developers can create IIS websites with several tools, including WebDAV which can create and publish web content.

The Differences between Apache and IIS are:

1. Platform Compatibility

• Apache:
  • Cross-platform, works on multiple operating systems including Windows, Linux, macOS, and Unix.
  • Widely used on Linux-based servers, which makes it popular for open-source web hosting environments.
• IIS (Internet Information Services):
  • Developed by Microsoft, primarily designed to run on Windows operating systems.
  • Closely integrated with other Microsoft technologies like ASP.NET, .NET Core, and Windows Server.

2. Licensing and Cost

• Apache:
  • Open-source and free to use under the Apache License.
  • Community-driven with regular updates and security patches from a global community of developers.
• IIS:
  • Proprietary software included with Windows Server, but the cost is tied to Windows licensing.
  • Requires a paid Windows Server license, which can add to operational costs, especially for large-scale deployments.

3. Performance and Scalability

• Apache:
  • Known for its modular architecture, allowing customization and configuration to enhance performance.
  • Suitable for handling small to medium traffic loads but may require tuning for high traffic websites.
• IIS:
  • Highly optimized for Windows environments and performs well with Microsoft technologies.
  • Scales efficiently with built-in load balancing and support for large enterprise applications.

4. Security Features

• Apache:
  • Offers strong security features with extensive documentation on securing configurations.
  • Has a larger attack surface due to its extensive use in different environments, requiring careful configuration and regular updates.
• IIS:
  • Integrates well with Windows security features, including NTFS permissions, Active Directory, and built-in authentication methods.
  • Generally considered secure in Windows environments but depends heavily on proper configuration and patch management.

5. Configuration and Ease of Use

• Apache:
  • Configuration is done through text files (e.g., httpd.conf), which can be complex but highly customizable.
  • Requires more manual editing of configuration files, making it flexible but potentially daunting for beginners.
• IIS:
  • Offers a graphical user interface (GUI) through the IIS Manager, making it easier for administrators to configure and manage.
  • More user-friendly for those familiar with Windows environments, with less reliance on command-line configuration.

6. Support for Programming Languages

• Apache:
  • Supports a wide range of programming languages including PHP, Python, Perl, Java, and Ruby.
  • Highly flexible in integrating with different back-end technologies due to its modular nature.
• IIS:
  • Optimized for Microsoft technologies like ASP.NET, .NET Core, and C#.
  • Can also support PHP, but it’s less flexible compared to Apache when it comes to non-Microsoft languages.

7. Extensibility and Modules

• Apache:
  • Highly modular with a vast number of available modules (like mod_rewrite, mod_ssl) that can be added or removed based on needs.
  • Custom modules can be developed, allowing for significant customization.
• IIS:
  • Extensible through modules but not as modular as Apache.
  • Supports both native and third-party modules, but the range is generally narrower compared to Apache’s vast ecosystem.

8. Market Share and Use Cases

• Apache:
  • One of the most widely used web servers globally, often found in Linux hosting environments, shared hosting, and small to medium business setups.
  • Popular among developers and businesses seeking open-source, customizable solutions.
• IIS:
  • Commonly used in enterprise environments, particularly where Microsoft technologies dominate.
  • Preferred in Windows-based IT infrastructures, corporate intranets, and large-scale enterprise applications.

9. Logging and Monitoring

• Apache:
  • Logs are stored in plain text and can be easily accessed and analyzed using various tools.
  • Provides detailed logging options but requires additional software for advanced monitoring and analysis.
• IIS:
  • Offers advanced logging and monitoring features integrated with Windows Event Viewer and Performance Monitor.
  • Provides detailed analytics and logging capabilities, making it easy to integrate with enterprise monitoring tools.

10. Community and Support

• Apache:
  • Backed by a large open-source community with extensive online documentation, forums, and community support.
  • Regular updates and community-driven development keep it up-to-date with security and feature enhancements.
• IIS:
  • Supported directly by Microsoft with official documentation, enterprise-level support, and updates.
  • Suitable for businesses needing official support and reliability, especially in mission-critical environments.