Development Model

On the other hand, IIS is typical of many Microsoft Windows-based products. It supports the Windows GUI and provides integration with other Windows mechanisms, such as Active Directory, MS SQL Server and Windows Security services. IIS also leverages the benefits of COM+. On the downside, IIS requires additional Microsoft products, such as Windows 2000 or Active Directory. This dependency causes a worry of potential lock in to Microsoft products and strategy for some companies.

Standards Support

Standards support is very important in many government contracts and procurements. The following table summarizes the standards support implemented by Apache and IIS.

Web Server Prerequisites

A major difference between Apache and IIS is their prerequisites. While Apache is available for many Unix versions, Linux, Windows and OS/2, IIS can run only in the Windows environment. What’s more, the latest version of IIS will run only on Windows 2000 server.

Administration Considerations

Both Apache and IIS provide many built-in administration functions. These functions include:

• Web server administration using scripts for commonly performed functions
• Support for multiple hardware virtual servers using separate IP addresses
• The ability to manage multiple Web servers as one server
• Support for multiple software virtual servers using host headers

Unlike Apache, IIS provides GUI support for server administration. One of the projects under the auspices of the Apache Software Foundation is to develop a graphical configuration tool for Apache. Additional information on this project, including a mailing list, can be found at http://gui.apache.org/. GUI-based and browser-based administration products are also available from third parties for Apache. One such product is the Plesk Server Administrator from Plesk.

Besides administrative GUI support, IIS also provides the ability to administer one or more IIS Web servers from a Web browser. IIS also provides some common administration functions available with other Microsoft products, such as a setup wizard and unattended/remote setup and maintenance. IIS even provides integration with Windows operating system functions such as directory services, backup and restore of IIS configuration information and the Windows performance monitor (to view IIS performance data).

Log Considerations

Both Apache and IIS can write to multiple logs using standard and extended log formats (from the W3C) and can even support custom logging. Both products permit logging to text files. Both products also let you automatically close an aging log file and open a new file based on elapsed time.

Here again, IIS provides better integration with Windows OS facilities. For example, IIS can write file security and application events to the Windows event log, which can then be viewed using standard Windows tools, such as Event Viewer. IIS also provides logging to any ODBC database. In fact, multiple IIS servers can log to a single ODBC database. Logging to an ODBC database in Apache is possible, but only through an add-on. Likewise, modules are available outside the official Apache distribution that provide log file analysis, data distribution and so on.

Security Considerations

Both Apache and IIS support basic security features out of the box. These include:

• Restrict access by domain name
• Restrict access by user
• Restrict access by group
• Restrict access by directory and/or file
• Restrict access by IP address
• Basic HTTP user authorization with clear-text passwords

However, IIS provides the ability to integrate Web server security with Windows security features. For example, Windows supports ACLs (access control lists), which IIS can use to administer Web server security. Moreover, Windows 2000 can store its ACLs in Active Directory and support authentication using digital certificates (such as those that conform to the X.509 certificate standards). IIS can then leverage these security mechanisms directly.

Process/Thread Considerations

Both IIS and Apache provide isolation between different Web client access requests. Apache, in its current standard distribution, forks processes in response to incoming Web client requests. This approach tends to be more resource-intensive than spawning threads within a process, which is the approach adopted by IIS. However, thread support will be one of the main enhancements to arrive with Apache 2.0.

Content Management Considerations

Both Apache and IIS provide functions for content management, such as:

• Content expiration
• Multiple platform support for content store and make commands
• Built-in image map handling
• Custom HTTP headers
• HTTP redirects
• Document footers
• Custom error messages

Additionally, IIS provides Windows-style tools, such as HTML page and site wizards as well as HTML templates. With its tight Windows integration, IIS can also provide enhanced file system security.

Conclusion and Other Alternatives

If you run a Windows-centric environment, and you prefer the service and support offered by Microsoft, your natural choice should be IIS. If you run a cost-conscious, heterogeneous environment, and you have a staff with Web server expertise, your natural choice should be Apache.

Although we’ve been discussing IIS and Apache, there are other options you should be aware of. For example, if you prefer service and support from a commercial vendor, you do not want to be locked into a Microsoft solution, and you have a Java-rich environment, your natural choice should be iPlanet from Netscape. If you prefer Apache but want additional modules not included in the base distribution and want service and support from a commercial vendor, consider solutions such as WebSphere from IBM.

Comments on this article? Please send them to Raj Rajagopal at rajagop@mitre.org

References

See our recent preview of Apache 2.0.

Useful Web sites: