up vote -1 down vote favorite
share [g+] share [fb]

What are the differences from security point of view running a web server on linux and running a web server on windows. I heard that almost nobody going to attack linux machine. Is that true? or Linux is hard to attack and nobody want to waste his time?

link|improve this question
80% accept rate
what is that -1 means? – student Mar 12 '10 at 20:49
1  
It means that people are voting down your question because they think it's subjective and argumentative. – 3dinfluence Mar 12 '10 at 20:57
I think your question is valid but perhaps poorly formed. In the future I would avoid putting phrases like "I heard" in a question as you start to blur the line between rumor/gossip and fact/a question. Your best trying to write question as neutral as possible especially on highly volatile subjects like Linux vs Windows. – 3dinfluence Mar 12 '10 at 20:58
feedback

closed as not constructive by Zoredache, squillman, Sam♦, splattne♦ Mar 14 '10 at 8:05

This question is not a good fit to our Q&A format. We expect answers to generally involve facts, references, or specific expertise; this question will likely solicit opinion, debate, arguments, polling, or extended discussion. See the FAQ for guidance on how to improve it.

2 Answers

up vote 2 down vote

Linux certainly is and can be attacked. But assuming two properly configured and maintained servers, aka regularly patched, the risk is about equal. Most of the problems with web servers come when you're running a CMS or web app of some sort. Most of which are poorly programmed and become the target for the attack.

For the OS and web server stack itself the main difference I think you'll see is the amount of time it takes to patch a vulnerability. Microsoft doesn't have as good of a record when it comes to that compared to the open source world.

link|improve this answer
feedback
up vote 2 down vote

Attacks against web servers these days is most commonly done via the configured web applications. If you are running a vulnerable version of Wordpress or some other commonly deployed web application then it doesn't matter too much if you have IIS or Apache.

Linux boxes are being probed constantly for vulnerabilities if nothing is done to block it. Just do a search here for 'denyhosts'. You will see many questions about people trying to remotely access linux boxes via SSH.

link|improve this answer
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.