Web Servers

About this part

A web server is the program that answers when a browser asks for a page. Apache and Nginx run a large share of the world's websites, so they are also among the most attacked programs on the internet.

In this part you install both Apache and Nginx on Amazon Linux and on Ubuntu. You see where their configuration files live and how to read them. You also host a simple static website. Then you change the configuration safely: test it before you reload, keep a backup, and check the logs when something goes wrong.

Example: suppose a college in Pune hosts its admission page on Nginx. If someone changes the config without testing (nginx -t), the whole site can go down during admission week. Knowing the safe way to edit and reload prevents that.

From a defender's view, you will learn which files matter most: access logs, error logs, the server blocks or virtual hosts, and file permissions. Later, when you study web attacks, you will recognise their traces in these same logs.

Examples you will meet in this part. nginx and Apache both serve HTML, and both often sit in front of application servers: Tomcat for Java, Gunicorn for Python, PM2 for Node.js, PHP-FPM for PHP and Kestrel for ASP.NET Core. Knowing the web server layer helps you protect all of them, with steps like hiding version numbers and turning off directory listing.

After this part you will be able to

1. Install nginx and Apache on Amazon Linux, Ubuntu and CentOS.
2. Host a static site and change its root folder safely.
3. Test a config before reloading, and read the access and error logs.
4. Hide the server version and turn off directory listing.

A real-world picture

Suppose we are a junior web admin at a BookMyShow-style site before a big movie release. Traffic will jump, and a config typo would be costly. With this part you change settings using test-then-reload, and you watch the access log for errors in real time. Globally, nginx and Apache together serve a very large share of all websites, so attackers study them closely. That is why version hiding and safe defaults matter. Everyday analogy: a shop counter. Arrange it well and keep the till locked.

Beginner questions I get in class

Q. Should I learn nginx or Apache first?
Learn both at a basic level. nginx is more common as a reverse proxy in new setups, and Apache is still everywhere in shared hosting and older systems.

Q. Do I need a domain for this part?
No. The public IP is enough. Domains come in Part 6.

Q. Is it safe to practise on the free tier?
Yes, if you allow SSH only from your IP and stop the instance when you finish.

Key terms

• Virtual host / server block: One website's settings on a shared web server.
• Document root: The folder files are served from.
• Access log: One line per request: IP, time, URL, status code.
• Error log: Problems and warnings from the server.
• Reload: Apply new config without dropping visitors.
• Directory listing: Showing a folder's files when there is no index. It should be off.

Mini case study

Suppose we are a junior analyst at Tata Consultancy Services, asked to review a new web server on AWS before launch (with the client's written approval). The checklist from this part becomes a short report: what you checked, what you found (for example "port 22 open to 0.0.0.0/0" or "directory listing on"), the evidence (a command and its output), and the fix. Clear, evidence-based reports like this are how defenders work every day.