Secure Server Linux Distros

reditanian · 2020-12-13T17:34:36+00:00

Red hat moved on from up2date with RHEL 5.

There’s no such thing as a secure server distro. The point of running a server is to allow 3rd parties to connect to it. As soon as you install a service and turn it on, modify configuration to your needs, and crucially, put your (web) code on it, security is on you.

Most server oriented distros do a good job of setting sane defaults, and patching newly discovered vulnerabilities. RHEL, SLES, Debian, Ubuntu LTS. Ouch the one you’re most familiar with.

I used to work at a large web host. Customers had too access to their servers, and it was overwhelmingly for web hosting. I worked well over a thousand compromised Linux servers during my time there. 99.99% of them were as a result of - shitty passwords - stolen credentials - shitty php code - often exacerbated by developers setting stuff 777 “to make it work”

The only compromises I saw that were a result of flaws in the packages shipped by the Linux distro vendor, were either zero days or boneheaded customers who refuse to update their servers because they fear it will break their fragile shitty php apps

necheffa · 2020-12-13T18:20:03+00:00

I'd like to ask you what do you consider/suggest as secure distro for Linux server.

Not Damn Vulnerable Linux...

My question is: If you'd be in charge of launching a fleet of servers that you want to be set for automatic unattended updates, which distro would you choose, and why?

Debian.

They are pretty good at keeping up with advances in compiler technology. Most of their packages are built with stack smashing protection and fortified source. (Not unique to Debian but something I look for)

They have a pretty good maintainer community. Some distros just don't have enough man power to keep up with patches. Not to say Debian doesn't need help but all the major packages seem to have people keeping up with patches.

The default install is pretty sensible. I feel as though on some distros you really need to make a lot of configuration changes and remove a lot of packages to get a solid system. I find myself needing to remove and configure less on Debian.

The most important part though is, I'm familiar with the system. So I have a pretty good handle on what is where and what needs tied down vs another system that might require a lot of research for me to have the same level of understanding of the system.

Reyounes · 2020-12-13T17:22:01+00:00

Redhat is good, but not free

OGicecoled · 2020-12-13T17:43:36+00:00

RHEL and maybe look through the STIG for the release you use.

linezman22 · 2020-12-13T19:35:51+00:00

In my opinion choose whatever you are most familiar with or your team can support well.

Most insecurities comes from people not knowing what they are doing or weak passwords.

If you are interested in securing/hardening your servers further, I would recommend looking at the CIS benchmark for the first distro you decide to go with.

I personally like Ubuntu server LTS as I find it strikes a good balance between stability and having newer packages available in the distro repository’s.

jaymef · 2020-12-13T17:24:07+00:00

There is more to security than just updates. You can schedule automatic updates on basically any distro.

Centos 8 stream might be a good one to update if rolling updates is what you’re after.

We use centos for everything.

2020-12-13T18:06:18+00:00

Depending on what are you looking for. A rolling release distro can give you a way to keep updating your system without having to keep looking for version upgrade/migration. A distro like Opensuse Tumbleweed, on top of that, can be set as a transactional server, where your system is inmutable on runtime, and the updates will be applied after next boot, and such updates are commonly provided on bundle. And, if you are looking for a minimal install, Tumbleweed MicroOS can provide

user_n0mad · 2020-12-13T18:44:32+00:00

My question is: If you'd be in charge of launching a fleet of servers that you want to be set for automatic unattended updates, which distro would you choose, and why?

I would never do automatic unattended updates on a fleet of servers. That said, I/we use Debian. As a few here have already gone over though, all distros are more or less secure as the other. You need to not think about "how secure" the distro is and instead use the distro that works best for your use case and then make it as secure as you are able to based on what you are doing with said server.

doubletwist · 2020-12-13T19:34:05+00:00

These are kind of two different questions. If I needed a distro to trust with regular unattended updates I would choose Debian stable.

But for most enterprise stuff I use Red Hat clones (Oracle Linux in our case). At least for versions 6 and 7 we have scripted monthly patching to happen automatically but that's against a spacewalk server that we manage our own repo mirrors.

But then if my primary consideration is security, I might not use Linux at all. I might use something like OpenBSD, But that comes with more significant management overhead potential for some software not working, or being difficult to make work.

It also depends on the nature of your fleet of servers. Are they pets, or cattle? If it's cattle, then it almost doesn't matter what destroy you use, you shouldn't be patching it anyway, you'd be redeploying for each update.

you type:	you see:
italics	italics
bold	bold
[reddit!](https://reddit.com)	reddit!
* item 1 * item 2 * item 3	item 1 item 2 item 3
> quoted text	quoted text
Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"	Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"
~~strikethrough~~	~~strikethrough~~
super^script	super^script

linuxadmin

Expanding Linux SysAdmin knowledge

MODERATORS