Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Can you rely on Nginx to be your only webserver. I know in terms of performance it works well, but how does it do in terms of security. I know Apache is stable and has ModSecurity. This is not the case for Nginx.

I am going to use Nginx as only webserver, and only for dynamic content. All my static content is delivered by a CDN.

share|improve this question
    
Your question is too generic. I think it would make more sense if you'd add what you expect from Nginx in terms of security/stability. –  Alexander Azarov Apr 18 '10 at 7:16
    
I do not really know how to be more specific. I am going to run a php/mysql website on the server. Are there some serious downsides on using only Nginx. –  Saif Bechan Apr 18 '10 at 7:27
    
What would you expect a good webserver should have? –  Saif Bechan Apr 18 '10 at 7:29
    
I have Nginx (only) at my pretty busy web site and I am absolutely satisfied with it. –  Alexander Azarov Apr 18 '10 at 18:35

3 Answers 3

up vote 9 down vote accepted

nginx runs dynamic content by 'reverse proxying' to a fastcgi server. the php-cgi package in most distributions include fast-cgi mode, where php will startup a small fcgi server you can connect nginx too.

This separation lets you do clever things:

  1. Most dynamic languages (php, perl, ruby,python) have a way to run fcgi applications
  2. You can run dynamic content as different accounts. Or, even under chrooted paths. On a VPS I manage for a few friends, every user has their own FCGI server running their own accounts. If their software is comprimised, the attacker can only get as far as that user account.
  3. It encourages an easy scale-out path for most applications. nginx on any given server can probably handle more static load than dynamic load. You can add multiple hosts to an upstream section on nginx, and just keep adding backends as needed (scaling your database + filesystem is left up to you, however)
  4. Using multiple ports with an upstream section, with a single host, permits you to restart the wep app without incurring any downtime: (1) Start php-fcgi on another port (2) stop php-fcgi on the original port. nginx will automatically redirect requests from one port to the other
  5. Better Memory utilization. With Apache/Mod_Security/Mod_php each apache process has all those modules loaded in memory. While there is some copy-on-write memory shared between processes, once each process changes a page, that memory page is copied. By seperating these tasks, nginx can use a fairly tiny memory footprint, you can setup a dedicated web application firewall (ips/ids device, dedicated reverse proxy server), and you can manage the memory policy on your php application, all seperatly.

Updated: Per comments below, here are some links:

fastcgi_pass param - This is how you instruct nginx to pass a request to a fastcgi server. FastCGI works by passing variables (that intentionally look like CGI environment variables), but allow you to communicate any arbitrary data from the front end to the backend. In the debian distribution (and in the source distribution too, iirc) there is a fastcgi.conf file that includes all the default paramaters most toolkits need to get off the ground

Upstream Module - The Upstream module allows you to define multiple upstream servers that can be other web servers, fastcgi servers, or what not. The fastcgi_pass module includes a short example that uses upstream. Note that on a single-host system, you can even use unix domain sockets, and incur no TCP/IP overhead!

PHPFCGI Example - This outlines a complete sample configuration. I personally am a fan of daemontools (or runit, if your not a djb fan), and have written very simple wrappers to run php-fcgi under process supervision (which will restart if it abnormally terminates), but the script provided on that page is a SysV-style script you can toss in /etc/init.d/ and add the appropriate links in /etc/rcX.d/. In the script on that page, there are a few variables you can tweak to adjust the environment that your fcgi application runs as.

Virtual Hosting is facilitated with 'server' sections:

server { 
     server_name www.host.com host.com other_aliases;
     ... 
}
server { 
     server_name www.host2.com host2.com other_aliases;
     ...
}

See The section on server_name for additional details, the rest of that page has a lot of information on how the corehttp module can be configured.

In terms of security, Igor (lead developer) takes security seriously, and frequently participates on their very active mailing list. Here's a list of acknowledged security problems , and here's a list to their mailing list archive

share|improve this answer
    
This is interesting. Can you point to any documentation that would show us how to configure nginx to do this stuff? –  Matt Simmons Apr 18 '10 at 14:04
    
+1 Nice points made here. I too am interested in some configuration documents on this all. Esp the virtual host creation is something I definitely need. –  Saif Bechan Apr 18 '10 at 14:32
    
You guys should really check out the wiki linked on the nginx site itself. It has everything you need to know. –  Martin Fjordvald Apr 21 '10 at 16:07

I do run nginx with php-fcgi on high-loaded server it works totally amazing.

Security is a thing that you actually create yourself. Always. Please don't make a mistake by relying on some software that will magically protect you when it comes to real problems. It won't. Good coding and administrating will.

share|improve this answer
    
+1 Thank you for this insight. I will try this method and skip Apache all together. Can you recommend me some links on making sure I am aware of some mayor security issues. –  Saif Bechan Apr 18 '10 at 14:34
    
I am not sure there is a complete guide, but I've shown some common mistakes in PHP coding leading to security issues here: linuxquestions.org/linux/answers/security/… And there are plenty other more detailed manuals over the net. What of nginx & apache httpd: apache httpd seem to fail under 100+ reqs/sec on that server I was using, while that was a regular load. Yeah I guess it's my misconfiguration(I had to tweak system & nginx configs to make it work that fast) but apache httpd eats much more resourses, that is obvious, that is why we use nginx. –  edk Apr 18 '10 at 15:02
1  
The following guide helped me move off Apache + mod_php towards a complete nginx + php-fpm (fastcgi) setup, providing huge performance boosts for the 30+ sites I run on my server. This guide does not use the stock PHP-CGI binary, but explains why, and the PHP-FPM code that it patches into the PHP source is actually going to be part of the official PHP core going forward. Takes some patience and some time to get running but runs extremely well, for me anyway. Will depend a lot on your applications and the server. The guide: interfacelab.com/nginx-php-fpm-apc-awesome –  Brian Cline Apr 18 '10 at 20:50
    
Thank you both guys for sharing this information. This is quite a big step to take in a production environment. I have to go about this with great caution. –  Saif Bechan Apr 19 '10 at 0:49

I was under the impression that Nginx is only able to serve static content? This makes php a "mission impossible"

share|improve this answer
3  
No it is possible wiki.nginx.org/NginxConfiguration#PHP_via_FastCGI –  Saif Bechan Apr 18 '10 at 5:00
    
Nginx is a reverse proxy, it can server pretty much whatever you want it to, not just FastCGI. –  Martin Fjordvald Apr 21 '10 at 16:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.