Which Web Server?

If you've been lurking in the various forums and newsgroups
devoted to webmastering, you could hardly fail to notice the
heated debate going on at this time. No, it's not which is the
best browser. This debate is about web servers. More precisely,
which one is better: Apache or Internet Information Server
(IIS).

To tell you the truth, I've used them both (and a few others as
well) and the simple plain truth of the matter is these two web
server platforms are really functionally equivalent.

Ease Of Use

IIS is much easier for the novice as operators can maintain it
from easy-to-use screens and forms. Windows 2000, on the other
hand, costs a lot more than other operating systems such as
Linux, FreeBSD and Unix.

Straight Apache requires a huge learning curve to learn how to
operate and administer. Everything is configured in extremely
obscure text files, and these configurations are done by hand
(although you can purchase add-on utilities to enable entry of
much of this information from screens and forms.)

Security

The security model of IIS is one of the best ever designed,
based as it is upon NTFS (the security model of Windows NT and
Windows 2000). This model is far superior to the anything
provided with Apache for non-Windows systems. Of course, on
Windows, Apache can use NTFS as well.

Of course, IIS has been plagued with a number of vulnerabilities
lately, and these are a concern. It's common to patch IIS at
least monthly, and to install a new service release (a
collection of patches) twice a year. Most of the bugs were
worked out of Apache (prior to version 2) long ago. Of course,
with the release of version two of Apache you can expect a
number of security and other flaws to surface - these are a
normal part of a product's life cycle.

Customization

IIS does NOT have the equivalent of HTACCESS. The HTACCESS file
in Apache is used to individually configure virtual sites (web
sites) without restarting the web server. However, on IIS you
have a very flexible method of configuration with ISAPI filters
and other similar methods. Both methods (HTACCESS and ISAPI
filters) are very obscure and for advanced webmasters.

Efficiency

According to several reports that I've come across lately IIS
is more efficient than Apache. My own testing has led me to
conclude the performance of the two is roughly the same for
static pages. PHP (the server side scripting platform common on
Apache) tends to be more efficient than ASP (the server side
scripting system for IIS) according to many sources, although I
have tested neither for speed.

Hardware Requirements

I have run both web server platforms on large and small boxes
of many different configurations, and I've found they require
much the same hardware. This is not surprising, since the two
platforms basically do the same thing.

When you configure Windows and IIS, it's a good idea to strip
the operating system of unneeded functions. This reduces the
size box you need (as well as increasing security).

I've run both platforms on 64mb of memory with a single 5600
RPM IDE drive and 200mhtrz processors with reasonable response
time (all things considered). I've also run them on dual
2gigahertz systems with 15k RPM SCSI raid 10 drives with
incredible performance. The two platforms are equivalent in
hardware needs.

Large Server Farms

Microsoft has worked hard on load balancing, so there are more
options available for IIS and Windows 2000 for this than other
operating systems. In fact, Windows 2000 clustering (the
ability to run several servers using the same disks) is very
advanced and makes disaster recovery a breeze.

Disaster Recovery

IIS backup solutions (those which are provided with Windows
2000) are surprisingly weak. There is no way to back up the
metabase (all of the IIS configuration parameters) from one
machine and restore it to another (which makes disaster
recovery difficult). On the other hand, with Apache it's just a
matter of saving all of the configuration text files.

Language and other support

IIS and Apache both support CGI, SSI and PERL (ActivePerl on
IIS is excellent). IIS natively supports ASP and I'm sure you
could find PHP if you looked (I have not). Apache tends towards
PHP, although you can install something like Chilisoft ASP if
you want.

CGI, SSI and PERL are performance hogs and security nightmares
in both web platforms.

Stability

Both web platforms are rock solid stable. I have run apache
servers which have stayed up for longer than a year without a
reboot, and my IIS servers have run for years with the only
rebooting required is the occasional service pack and security
patch. Neither web platform (or OS for that matter) has even
once crashed due to a bug.

Operating System Integration

IIS and Windows 2000 is a more "integrated" environment than
Apache, since IIS is targeted specifically for the operating
system. This has the advantage that the GUI and controls of IIS
look and feel the same as every other tool on Windows.

On the other hand, you can find Apache for just about any
platform, including Lunix, Unix, BSD, and even such things as
OpenVMS. If you need to be able to move between platforms, then
Apache is a great choice.

Email

SMTP on IIS is primitive but functional. This is because it is
only provided to allow scripts and such to send email from the
server. If you need additional email support, you are expected
to use Exchange or some other email system.

Apache does not support SMTP (sendmail), although a version is
usually provided on the target system. The provided email
solution is full featured - but you must be very sure to check
the configuration to be sure your system is not an open relay.

The IIS SMTP module is configured through the standard Windows
2000 entry system, while Sendmail requires configuration file
editing. IIS SMTP is absolutely trivial to maintain; Sendmail
can be a challenge.

DNS

DNS on Windows 2000 is far, far superior to anything available
on Unix or Linux. Bind (he DNS for Unix and similar systems)
has traditionally suffered from a huge number of security
vulnerabilities) and is very involved to maintain.

My own experience with DNS servers indicates the best solution
is a dedicated DNS application box. These are inexpensive (for
a business), easy-to-configure and much more secure than either
the Windows 2000 version or the Unix version.

Search Engines

There is NO difference as far as search engines are concerned
between Apache and IIS (or any other web server, for that
matter).

Conclusions

I'm sure I could write for hours and hours about this subject
(and perhaps I will in an article on my own web site).
Basically, IIS and Apache do the same thing. They have a vastly
different design philosophy, however, and the underlying
operating systems have even wider differences.

My experience is that Linux and Unix people prefer apache,
and windows people prefer IIS.

To me, the choice of webserver really comes down to "what are
you and your group comfortable with?" If your experience is with
apache, linux or unix, then you probably want to stick with
Apache. If your experience is with Windows, then you will
probably be uncomfortable with Apache.

I've used both (and several others) and quite frankly, to me,
it does not matter. Drop me on a server running apache or IIS,
and I will feel at home.