Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just had an interesting meeting with security guys and the main point of this meeting I wanted to have some backup on is:

Apache is secure, because it only needs port 80 and 443 (for http and https access) open. IIS would need much more ports open to the clientside because it also needs DNS and other stuff.

This sounds very fishy and don't get me wrong: I like apache as much as I like IIS, but I'm not the expert in firewall and network-configuration: I would need some opinions on that.

For answers, please just assume the newest versions of apache and IIS.

share|improve this question
add comment

3 Answers

up vote 7 down vote accepted

There's no reason whatsoever that an IIS server HAS to have more ports open to it than an apache server. Now in reality perhaps it would have more ports that you MAY wish to open between it and the servers behind it (AD etc.) but if you had front and rear interfaces you'd only open them on the rear anyway, making IIS just as capable of running with 80/443 on the front ports as apache.

share|improve this answer
add comment

I have a feeling your security guys are feeding you a load. I've only got ports 80/443 open on the front end of my server and I have no issues whatsoever.

share|improve this answer
add comment

As others have mentioned, one HTTP server (IIS/Apache) doesn't need any more ports open than the other. What they seem to be confusing / obfuscating is further down below the HTTP server. Windows joined to an Active Directory domain is very much reliant on DNS.

A diagram of where the servers are sitting in relation to any firewalls would help. It sounds like the web server is supposed to be public facing. If that's the case, is it in a DMZ?

I agree with the others, though. There should be no reason that you need to expose more than 80/443 to the public, in any situation.

Edit:
In your DMZ, if the Windows box has to be joined to an AD domain and there is no DC in the DMZ (which I'm guessing there isn't) then additional ports will need to be opened in order to communicate with DNS and AD.

Now, I'm not a *nix god but if there's any kind of central authentication happening for Apache I think that's also going to be the case. Maybe that has already been set up, though, and they are pushing more for using the existing configuration.

Bottom line: the statement that IIS needs additional ports open is simply not true. All of the underlying services MIGHT need to have more ports opened but it's completely dependent on how the web app will work and how it is managed. For straight HTTP services the std ports 80/443 are all that is needed.

share|improve this answer
    
It's not even public facing: it's in an internal DMZ. I cannot give you any more details on the network infrastructure for security reasons ;) –  MADMap Aug 23 '11 at 13:58
1  
Sorry, not acceptable. We need full schematics :) See my edit. –  squillman Aug 23 '11 at 14:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.