Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I run a browser-based game and as part of a page with a bunch of game statistics, I have the server uptime listed. It's currently at 177 days and so someone mentioned to me that I shouldn't do this because a long uptime indicates the kernel is old and therefore missing security updates.

This certainly sounds logical, but I searched around and couldn't find any evidence to support it. So I'm just wondering, is this indeed something I should not have exposed?

share|improve this question
    
How do they know you're not running a cluster? –  gravyface Feb 27 '11 at 22:38
    
I'll plug ksplice uptrack. –  Tobu Feb 27 '11 at 22:40

2 Answers 2

up vote 2 down vote accepted

This is nonsense, IMHO. When someone wants to attack you, he will try all possible attack vectors anyway, so if your system is vulnerable, not displaying your uptime won't help. Besides, things like ksplice and module updates exists, allowing patches without affecting your uptime.

share|improve this answer
    
+1 - I was about to mention ksplice. You can have a fully up-to-date kernel and a massive uptime. –  Mark Henderson Feb 27 '11 at 22:56

Hope this helps:

How often should I reboot Linux servers?

While not an exact answer to your question this should give you an idea.

In short if you keep it up to date security wise I wouldn't worry about exposing that info.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.