Cis Apache Http Server 2.4 Benchmark

Posted on  by admin
  1. Cis Apache Http Server 2.4 Benchmark Test
  2. Cis Apache Http Server 2.4 Benchmark Free

This document, CIS Apache 2.4 Benchmark, provides prescriptive guidance for establishing a secure configuration posture for Apache Web Server versions 2.4 running on Linux.

Cis Apache Http Server 2.4 Benchmark

Checklist Summary:

This document, CIS Apache 2.4 Benchmark, provides prescriptive guidance for establishing a secure configuration posture for Apache Web Server versions 2.4 running on Linux.

Checklist Role:

  • Web Server
  • CIS Apple macOS 10.12 Benchmark. MAC OS X 10.12 (Sierra) cisapplemacOS10.13. CIS Apple macOS 10.13 Benchmark. MAC OS X 10.13 (High Sierra) webvulnerabilities. System audit for web-related vulnerabilities. CIS Apache HTTP Server 2.4 Benchmark. Apache configuration files. CIS benchmark for Oracle.
  • Apache HTTP Server Version 2.4. But it has such a drastic effect on the perceived performance of Apache that it had to be replaced. As of Apache 1.3, the code will relax the one-per-second rule. It will spawn one, wait a second, then spawn two, wait a second, then spawn four, and it will continue exponentially until it is spawning 32.

Known Issues:

Not provided.

Target Audience:

This document is intended for system and application administrators, security specialists, auditors, help desk, and platform deployment personnel who plan to develop, deploy, assess, or secure solutions that incorporate Apache HTTP Server 2.4 running on Linux.

Target Operational Environment:

  • Managed

Testing Information:

This guide was tested against Apache Web Server 2.4.3 - 2.4.6 as built from source httpd-2.4.x.tar.gz from http://httpd.apache.org/ on Linux.

Regulatory Compliance:

Http

Not provided.

Comments/Warnings/Miscellaneous:

Not provided.

Disclaimer:

Please see the below link for our current terms of use:https://www.cisecurity.org/cis-securesuite/cis-securesuite-membership-terms-of-use/

Product Support:

[email protected]

Point of Contact:

[email protected]

Cis Apache Http Server 2.4 Benchmark

Sponsor:

Not provided.

Licensing:

Cis Apache Http Server 2.4 Benchmark Test

Please see the below link for our current terms of use:https://www.cisecurity.org/cis-securesuite/cis-securesuite-membership-terms-of-use/

Change History:

Dependency/Requirements:

URLDescription

References:

Reference URLDescription

Cis Apache Http Server 2.4 Benchmark Free

NIST checklist record last modified on 11/04/2020

I wrote a little while ago about how, for running PHP, Nginx was not faster than Apache. At first I figured that it would be and then it turned out not to be, though only by a bit.

But since Apache also has an event-based MPM I wanted to see if the opposite results were true; that if Apache were using its event MPM it would be about the same as Nginx. I had heard that Apache 2.2’s event MPM wasn’t great (it was experimental) but that 2.4 was better, possibly even faster, than Nginx.

So I had a few spare moments this Friday and figured I would try it out. I basically ran ab at concurrency levels of 1, 10, 25, 50, 100 and 1000. Like before the results surprised me.

Cis Apache Http Server 2.4 Benchmark

The first run with Nginx was impressive. It peaked at 14,000 requests per second. Given my wimpy VM that I ran it on, those numbers are pretty good. What surprised me was that Apache was only half that. I will say for the record that I do not know how to tune the event MPM. But I don’t really have to tune Nginx to get 14k requests per second so I was expecting a little better from Apache. So I pulled out all of the LoadModule statements I could but still have a functional implementation of Apache. While the numbers were 25% better or so they were still well shy of what Nginx was capable of. Then I added the prefork MPM to provide a baseline. Again, I was surprised. The event MPM was faster than the prefork MPM for static content, but not by much.

So it seems that if you are serving static content Nginx is still your best bet. If you are serving static content from a CDN or have a load balancer in front of Apache which is running PHP then the prefork MPM is the way to go. While the event MPM will help with concurrency it will not help you speed up PHP and so is not really needed.