Need Web Server for HP-UX

[Trojan36]

Looking for a web server with CGI capabilities, please provide any suggestions. Any other web server besides Apache and Sun One? Thx in advance.

[Steven Schweda]

What's wrong wuth Apache?

http://www.hp.com/products1/unix/webservers/apache/downloads/

It's free. HP appears to support it.

[Torsten.]

Try this link

http://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXWSSUITE

and note this statement:

"HP-UX Web Server Suite is supported by the HP Worldwide Response Centers for customers with an HP-UX support contract."

[Trojan36]

The decision on not to useApache is a company direction. Therefore, I was looking for other web servers that does CGI on HP-UX.

[Steven Schweda]

> The decision on not to useApache is a
> company direction. [...]

So, ask the fellow who prohibits you from
using the most popular available Web server
which one you should use instead. (Or, just
ask, "Why?")

[Torsten.]

If you search the internet for "The world's most popular Web server software" I already know what you will find (see above).
Even all other "flavors" are at least apache based, like this:
http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=Protected-WS

Another commonly used server software won't run on hp-ux, because it is called IIS.

If you find another software with comparable features and safety for hp-ux, on which you can even get support if needed, please let us know.

[Torsten.]

You should also read this:

http://news.netcraft.com/

Have a look at the graph:
http://news.netcraft.com/archives/2008/01/overallc.gif

[Steven Schweda]

> You should also read this: [...]

Why? "The decision on not to useApache is a
company direction." End of argument,
apparently, so no further thought is
required (or permitted). In this situation,
facts become a burden, not a help.

[Torsten.]

I think you are right Steven.
;-)

I still hope he will clarify this decision.

[Steven Schweda]

I'll admit that I'd like to know the
reasoning behind that decision, but I won't
be holding my breath while I wait for it.

[Paul Sperry]

Well if you really can't use Apache. The following site lists a few alternitives.


http://www.w3.org/Servers.html

[Paul Sperry]

Well if you really can't use Apache. The following site lists a few alternitives.


http://www.w3.org/Servers.html

Also take a look at jigsaw
Jigsaw (W3C's Server) comes from the World Wide Web Consortium. It is open source and free and can run on various platforms like Linux, Unix, Windows, Mac OS X Free BSD etc. Jigsaw has been written in Java and can run CGI scripts and PHP programs.

http://www.w3.org/Jigsaw/

[Trojan36]

The company decided not to use Apache because it was detected it has security threats. I couldn't to describe you which ones but there are specialists in the company whom decided this. That's all I know, which was why option beside Apache was needed. Thx all for the replies.

[Steven Schweda]

> The company decided not to use Apache
> because it was detected it has security
> threats. [...]

And the "company" is sure that this
distinguishes Apache from all other Web
servers on the market? Interesting.

You have my best wishes in your search for
another Web server which has no serious bugs.

[Olivier Masse]

I always have the exact same debate with our security people. Especially if it's a Windows guy who can't possibly understand that the Unixes tend to borrow lots of open source technologies. It's the same problem not only with Apache, but with Secure Shell based on OpenSSH, the stock FTP daemon based on wu-ftpd, sendmail based on... sendmail. The list goes on and on.

What I usually tell them, and write in their inventories, is that I'm not using "Apache", but "HP-UX Webserver Suite". Then they turn away and I'm free for another year. Saying this isn't a lie per se; HPWS is supported by HP, and all security issues are handled as if it was any other HP-UX subsystem with security advisories and patches. With that argument, I've been able to convince everyone up to now.

Good luck.

Olivier.

[Bill Hassell]

> The company decided not to use Apache because it was detected it has security threats.

I may be mistaken but I believe that there is no network service of any sort, whether it is a web server, ftp, ssh, telnet, ntp, etc without a security concern. So the correct answer is to disconnect the LAN cable immediately.

If the requirement for a web server is critical then *all* web servers must be evaluated. The most critical points will be:

1. CERT (and other agencies) vulnerability lists, specifically, quantity per month or year.

2. Time to resolve issues.

3. Ownership and responsiveness of the supporting entity to security issues.

4. Timely notifications about patches and fixes.

There is a very good reason that Apache is the most widely used web server. With HP support, it is at the top of the list for the above mentioned points. IIS is towards the bottom and all the rest fall below Apache.

I have found that security concerns are almost always based on old, unpatched servers (OS as well as Apache) just as with any other web server package.

But rather than fight the security professionals, use Olivier's advice and tell them you are installing the HP Webserver Suite.