Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What are the differences from security point of view running a web server on linux and running a web server on windows. I heard that almost nobody going to attack linux machine. Is that true? or Linux is hard to attack and nobody want to waste his time?

share|improve this question

closed as not constructive by Zoredache, squillman, Sam, splattne Mar 14 '10 at 8:05

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

    
what is that -1 means? –  student Mar 12 '10 at 20:49
1  
It means that people are voting down your question because they think it's subjective and argumentative. –  3dinfluence Mar 12 '10 at 20:57
    
I think your question is valid but perhaps poorly formed. In the future I would avoid putting phrases like "I heard" in a question as you start to blur the line between rumor/gossip and fact/a question. Your best trying to write question as neutral as possible especially on highly volatile subjects like Linux vs Windows. –  3dinfluence Mar 12 '10 at 20:58

2 Answers 2

Linux certainly is and can be attacked. But assuming two properly configured and maintained servers, aka regularly patched, the risk is about equal. Most of the problems with web servers come when you're running a CMS or web app of some sort. Most of which are poorly programmed and become the target for the attack.

For the OS and web server stack itself the main difference I think you'll see is the amount of time it takes to patch a vulnerability. Microsoft doesn't have as good of a record when it comes to that compared to the open source world.

share|improve this answer

Attacks against web servers these days is most commonly done via the configured web applications. If you are running a vulnerable version of Wordpress or some other commonly deployed web application then it doesn't matter too much if you have IIS or Apache.

Linux boxes are being probed constantly for vulnerabilities if nothing is done to block it. Just do a search here for 'denyhosts'. You will see many questions about people trying to remotely access linux boxes via SSH.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.