1

Is it OK/advisable to run both IIS6 and Apache on the same box in a live environment? Our developers want to use our live web server to install SVN using apache and I'm not to happy about it.

Cheers

John

4 Answers 4

2

It's certainly possible; we do it on a couple of our dev boxes; as long as you can manage two sets of ports (if you don't have a separate interface for each service to bind to) and keep them both secure, there's no practical reason why not.

I'm more troubled by the fact that it looks like you're going to have a copy of your SVN repository on your production webserver when you finish, meaning that anyone who manages to compromise either IIS or Apache could potentially access it all.

In my experience, giving developers installation rights on your boxes is a bad idea - I've personally seen one of our servers left compromise-able by a badly-secured, out-of-date install of PHPMyAdmin that nobody told me about.

2
  • 1
    My understanding is that developers indeed should have install rights (though preferably in a test environment), they're cunning enough to manage stuff and often request applications and services that are tough to maintain without the proper knowledge. Failing to give them the items they've requested will affect development productivity and will end up in a we-and-them-mentality, IMO.
    – dadver
    Jul 22, 2009 at 9:26
  • It's a bit of a catch-22, isn't it? Don't give them root and end up having to install the 200 pieces of random software that are needed, or give them root and face the consequences; IME, devs are more concerned with the app working than they are with the system's security. Of course, the real problem is the fact that the dev box was connected to the Internet in the first place.
    – RainyRat
    Jul 22, 2009 at 10:08
2

We do it and haven't run into any problems. Obviously they can't both use port 80 so you have to move one of them to a different port.

JR

1
  • 2
    They can both run on 80 when binding to different IP addresses.
    – Arjan
    Jul 22, 2009 at 9:28
1

I'll add to what the others have said by saying that in a dev environment it's absolutely fine - just bind IIS and Apache to different ports. (In fact, the installer for Visual SVN Server doesn't use port 80 or 443 by default IIRC.) Just view them as two completely separate bits of software, just because they both happen to be HTTP servers doesn't mean there will be any kind of "conflict".

However like the others, I would not recommend putting source code on your live web server for security reasons (namely IIS or an app running on it being compromised)

1

I agree about not storing source code on a public live server, but nevertheless, if you want to run both servers on port 80:

When configuring both IIS and Apache to run on port 80 using different IP addresses, then see Setting metabase property DisableSocketPooling has no effect if your IIS 6.0 simply claims all available IP addresses. Adobe has some notes on this in How to configure Breeze and IIS to use port 80 on separate IP Addresses.

To have both IIS and Tomcat (the Java container; not Apache HTTP Server) available on port 80 on the same IP address (but using different domains, or different paths within the same domain), I've set up quite a few instances of Tomcat sitting behind IIS, using the ISAPI IIS-Tomcat Redirector. I can imagine something simular would be available for IIS and any other HTTP server. However, I doubt you want to do this to combine a production server with a SVN server.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .