Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a root-server (i7/24GB/1TB) running Ubuntu 10.04 LTS as my OS. After some security audits (OpenVAS, Retina etc) I see that Ubuntu isn't the most secure system for a semi-corporate environment. Its updated from many sources, ofc from the Ubuntu security repo too. But nevertheless I could exploit my OpenSSL install with an exploit from August/September. There are some critical updates needed which Ubuntu does not provide. I was using Debian and Ubuntu for almost 5 years but now I doubt. What distro is secure and up to date from your point of view? How can I make the server more secure? Outsourcing of every software-module to a VM? I am not new to server-hardening, my packages are up to date I read Ubuntu Security Notices and I have no unneeded services installed on my server. Thanks.

share|improve this question
3  
Were you actually able to exploit your SSH server or did your audit just flag it b/c it was a version of OpenSSL that had a known vulnerability? The reason I ask is that all long term support/enterprise Linux distros will stay with the version of software they ship with. They will simply back port any security issues and in some cases major bug fixes to the version they shipped. So a vulnerable version number doesn't necessarily mean that your server is vulnerable. –  3dinfluence Dec 26 '10 at 20:59
2  
Also if you're curious as to what security issues Ubuntu 10.04 is vulnerable to and in most cases already fixed. launchpad.net/ubuntu/lucid/+cve is a good resource. You can probably look at the cve code from your audit and look it up there. –  3dinfluence Dec 26 '10 at 21:11

7 Answers 7

All of the big-name distros are actually quite good. However, Red Hat directly employs the largest security team — and employs the most direct contributors to the projects likely to be at risk. I don't mean at all to downplay the contributions of dedicated volunteers and of hard-working smaller teams, but Red Hat's dedication of resources to security is part of what makes theirs legitimately an enterprise Linux distribution.

I highly recommend reading Mark Cox's blog entries on RH security. He's the lead of their security response team, and the metrics he puts together are very interesting. (If anyone knows of anything comparable from another distro — or from any other company! — I'd love to know about it.)

share|improve this answer

Openwall GNU/*/Linux (Owl), a security-enhanced Linux distribution for servers and appliances.

share|improve this answer
    
User imz wanted to add a link to Openwall Linux 3.0: Linux for the security-conscious –  Chris S May 20 '11 at 15:32

Consider using BSD systems like DragonFlyBSD, OpenBSD, NetBSD, FreeBSD, instead of Linux. All these systems have tool to check packages/ports against available bugs and exploits. It can check package before installing it and also check all installed packages i.e. daily. See:

share|improve this answer
    
This is a good point but I am more familiar with Linux/Debian. Does it take long to migrate to BSD? My main services I use are Postfix+Antispam, Apache and Web-Frontend to controle many users. –  Drama Dec 26 '10 at 14:41
    
No, generally not. If you started to learn Linux, because you were looking for something much cleaner than Win OS, then BSD should be next natural step. –  plluksie Dec 26 '10 at 22:27

Both Canonical and RedHat provide extra services for a fee. Among these are timelier updates and a focus on security.

share|improve this answer

The OpenSSL vuln was discovered in late summer / early fall, but when was the release containing the fix.

Not to impugn upon the security of the BSDs (I happen to have a lot of respect for them), but I believe that they use the same package, OpenSSL. That means that they're vulnerable to the same threat.

Unless you're compiling directly from the project's repo, you're never going to have the absolutte latest-and-greatest. Doing that is fine for your desktop, but bad news for a server.

During that delay between the app update and it appearing in your system's update mechanism a buttload of compatibility and regression testing is happening. This is to ensure that the updated version works with your OS. If OpenSSL were to be patched without being tested and Canonical were to make it available via apt, and it broke your system, you'd most likely complain at Ubuntu, not OpenSSL.

Personally, I recommend sticking with what you know for production. It's better to have a moderately-secure OS managed by competent admins than a highly-secure OS by people unfamiliar with it. By all means, test and become familiar with other OSs and rigorously test your production apps with it, but don't jump ship hastily...

(BTW, this all assumes that the server that came up on the vuln test is fully patched...)

share|improve this answer
    
The package was fixed in late September. The current version in repos is 0.9.8k and the current OpenSSL is 1.0.0g if I recall. For a small company working its important to have a secure server which is used for e.g emails. We aren't developmers and the admins are familiar with Linux systems. Yes the system was fully patched. –  Drama Dec 26 '10 at 14:31
    
Personally I agree with your opinion about competence and security. Concerning OpenSSL - here are all security advisores for FreeBSD concerning OpenSSL in last few years and the way to patch system: security.freebsd.org/advisories/FreeBSD-SA-10:10.openssl.asc security.freebsd.org/advisories/FreeBSD-SA-09:08.openssl.asc security.freebsd.org/advisories/FreeBSD-SA-09:02.openssl.asc security.freebsd.org/advisories/FreeBSD-SA-07:08.openssl.asc Enjoy! –  plluksie Dec 26 '10 at 22:20

Not sure about Ubuntu, but Debian is pretty secure. Keep packages updated, install/configure proper firewall. dont run fishy services. Google "debian hardening" and you will find lots of step by step instructions that will give you good ideas.

regarding vulnerability scanners, take any "extra" secure linux/BSD distro. install packages with apache/ssl/php/ftp/etc and you will get bunch of alarms.

Since my servers are scanned quarterly I end up using both debian/redhat and compiling some of the packages myself using suggested by scanning provider versions.

share|improve this answer

Also there is "Hardened Gentoo". Some research I read some time ago (sorry, cannot find it now) mentioned that it implements more security technologies in its core than Ubuntu/CentOS/Debian. The list of these technologies is here.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.