Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Considering that it would have been laughed at by the unix/linux people to suggest windows as a internet connected server until the 2000 era, is that argument now laid to rest?

Aside from nix admins who dont want to lose their lucrative admin positions(because certain jobs take ages compared to windows, and vice versa) is there any reason ASIDE FROM COST, that linux is more secure after a professional has setup windows?

Considering the performance of modern hardware, I believe now that the tools and ease of use of windows platform make it an equally viable server platform.

Unless you require Open source technology that are ideally deployed on Linux, I see no reason for people to roll their eyes at windows, or ignore it as a viable platform.

What do you think?

share

locked by HopelessN00b Dec 5 at 8:11

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

2  
Can you suggest how to ask this question without it throwing up flame war type arguments? I'm looking for agnostic answers to back me up when I am faced with people rolling their eyes when I mention that we run our infrastructure on windows. Based on the answers so far I am getting exactly what I was looking for, and I phrased the question carefully to make sure it didn't just become a pointless debate. –  optician May 8 '09 at 13:10
2  
If they are rolling their eyes, don't bother, there's no use in arguing with people who aren't open. (no pun intended) –  altCognito May 8 '09 at 13:14
9  
Argumentative? I don't think so... Why can't people have a rational discussion of the pros and cons of this issue without resorting to flaming one OS or another? After all, aren't we all "professionals" here who are trying to further the cause of sysadmins across the spectrum? –  Milner May 8 '09 at 13:16
2  
I agree, there is, or was a difference between security on windows and linux, and were trying to get an answer as to whether this is still the case, in a sensible manner. The answers so far are doing that, and reflect the fact that we are quite able, as professionals to discuss this sensibly and look at the facts of the matter. –  Sam May 8 '09 at 13:27
    
I'd love to answer this question, since it is something that I have already studied and came to my own set of conclusions. The problem is that it is almost impossible to explain it without making a few people "unhappy", thus a tank of gunpowder waiting for a ignition. The short answer is "yes", they may have equivalent (not equal) security. The problem begins when you check the requisites to making both systems equivalently secure (aside from cost). –  Juliano Jun 21 '09 at 13:44

11 Answers 11

up vote 13 down vote accepted

The major problem with security is not actually with the platforms themselves, but with the popularity of windows. There are security holes in any system, its impossible to prove that bugs don't exist in anything but the most trivial of software. Windows and Linux both contain security holes that haven't been uncovered yet, however because of Microsofts popularity as a desktop OS, people looking for holes are more focussed on looking for holes in windows, because often there is more for them to gain by hacking hundreds of windows desktops, and unfortunately these hacks usually apply to server OS's as well as desktops. If Linux had become the dominant desktop OS then I think the situation would be reversed.

With the most skilled sysadmins, you can make any OS secure, however you cannot (without re-writing the OS yourself!) account for holes in the OS, not have not yet been discovered. WHen they are discovered its more down to the speed of the vendor providing a fix for the problem, than the sysadmins skill at securing the server. Most of the security breaches you hear of today are not due to lax system administration, but to a previously unknown security hole in the OS. Linux is as vulnerable to these as Windows, its just more people are looking for them in Windows.

share
    
I agree, this is exactly the impression I've always gotten from this debate. Sure, some incarnations of Windows may not have a perfectly solid security model, but then again there are hundreds of Linux distributions. Some (maybe even most) are bound to have many major security holes, waiting to be found if anyone were to try. But people probably won't, since the Linux following is distributed over all the different dists. –  Lucas Lindström May 8 '09 at 13:50
2  
And other people are usually quick to point out that the most widely deployed server on the internet, Apache, has not a comparable number of security holes. –  Adriano Varoli Piazza May 8 '09 at 14:53
1  
The exploits aren't usually for a distribution, but for a particular program. And although the distributions are all different, they are all built from the same pool of programs. So, for example, if your apache or ssh is kept current, then it doesn't matter which distro it's part of. –  gbarry May 8 '09 at 16:30
7  
I've seen this argument repeated and repeated hundreds of times. Is it true? Some 70% of servers are Unix and Unix-like (principally Linux). Internet attached servers surely are more significant target, then Joe Sixpack's laptop. So I don't buy "more focused on Windows" argument. –  vartec May 8 '09 at 16:55
2  
@vartec: The servers aren't the target because they usually have some competent administrator looking after them. For every web server you "recruit" for your botnet, there are potentially thousands of web client machines (mostly Windows) that you could be using whose users are far less likely to notice. –  Graeme Perrow May 29 '09 at 18:48

Unix people may scoff, but as long as you're diligent in applying patches, I think it's getting pretty close. Windows seems more prone to attacks simply because it's a bigger target. There are way more Windows machines out there, so that's where the malware authors dedicate their time. Also, Unix users on the whole tend to be more knowledgeable than Windows users, so it's more likely that your average Windows machine on the net is insecure than your average Unix machine.

I'm sure there are very few, if any, viruses that attack BeOS, but that doesn't mean that BeOS is the most secure OS ever. There's little point in virus authors writing BeOS viruses since extremely few people run it. That's an extreme example, but it's the same principle for Windows vs. Unix viruses. The more market share Unix / Linux / Mac OS X gains, the more malware you will start to see for those platforms.

share
    
Well, if UNIX people are more knowledgeable, it's probably because Windows is (or at least has been) more approachable to inexperienced users. –  Lucas Lindström May 8 '09 at 13:53
    
Yes, that's all I meant. I wasn't implying "Windows people are dumb", being a Windows guy myself. :-) –  Graeme Perrow May 8 '09 at 14:59

I guess there is a greater visibility of the system under Unix-like systems. The Windows compulsory GUI approach hides lots of details, sometimes important ones. For real security it is imperative that you possess the most information about what happens on the machine, and what measures are taken and to what extent. I dislike windows for hiding this all.

share
1  
Windows compulsory GUI? See Windows 2008 Core... no GUI. :) –  K. Brian Kelley May 8 '09 at 13:31
3  
@Brian - True, but it's taken them this long to finally get off their butts and do it. =) –  Lucas Lindström May 8 '09 at 13:54
1  
No argument, there, scarecrow, no argument there. –  K. Brian Kelley May 8 '09 at 14:33
    
If you've ever used 2008 Core ... You'll realize it's still a GUI. With a crappy DOS prompt. –  Joseph Kern Dec 27 '09 at 21:03

They're about the same. The advantage Linux has is you can pull components out you don't want or need, more so than with Windows. So if a vulnerability pops up in one of those components, you're still golden. With that said, a properly hardened Windows Server OS and IIS should be just as resistant. For instance, look at the interview with Charlie Miller. He took out Safari in seconds at PWN2OWN. He had an exploit for Chrome, but the sandbox + the OS protection is too much. And that's a good point. There's an awful lot of security built into the OS now. So chances are if you're going to be gotten, it's going to be a weakness in the web application itself.

share

Short answer, yes.

Looking at it the other way, both (or basically any) systems are easily made rather insecure - mostly by inexperienced administrators but there's a lot of other factors as well. Security is so much more than just technology.

And is this a server-use question? Because when it comes to Windows on the desktop - the sheer amount of client applications (many extremely good or best of their class) makes for a much bigger hole and easier target. The server-side I'd say is on a more equal footing, at least if you keep up with new releases and best practice configurations for both systems.

share

The issue is that the Windows OS is closed, and no matter how many patches they release, they simply leave doors open for others to get in by design.

While I'll agree that Windows is reasonably secure. But by definition it is by no means on par.

The argument that Linux is less popular and therefore less attractive as a target doesn't hold up for servers at all. Linux is typically targeted first because it is an easier platform to work with remotely. (because it was designed for such things)

share
    
<sigh...> Just to reply to the whole "Windows NT provides a secret back-door to the NSA" link from 1999, (which Bruce Schneier covered here: schneier.com/crypto-gram-9909.html#NSAKeyinMicrosoftCryptoAPI), the entire source code for Windows is licensed to and reviewed by many foreign governments through the Government Security Program (microsoft.com/resources/sharedsource/gsp.mspx). Even China has access (news.cnet.com/China-to-view-Windows-code/…). Wouldn't you think that China would have a problem with this backdoor if it really existed? –  Sean Earp May 26 '09 at 8:12
    
And to pre-empt the reply that I assume will come next, yes I work for Microsoft, but my thoughts are my own :) –  Sean Earp May 26 '09 at 8:14
    
@smearp Well, I agree with Bruce Schneier take on this (hard not to), but the China argument is sort of hollow. They use Linux for a lot of their stuff as well. –  altCognito May 28 '09 at 13:56

I really think, that this question rather then being real question is flame bait. But I'll give it a serious answer anyhow:

Consider for example services such as web server or MTA. In Windows they run with administrator privileges (eg. IIS runs as LocalSystem), while in Unices and Linux that's the way it was done… some 15 years ago. Since then each service has it's own, limited account.

Is it possible to have secure Windows site? Well, this site is example of such. But on the other side, there are millions of secure sites running Linux. Google, Amazon, Facebook, YouTube, Digg, Flickr…

share
1  
Actually, apache on Linux has been dropping from root to nobody since the original set of patches on NCSA, back in 1995 or so. It's amazing to me that so much stuff needs admin privs on Windows- even the screen saver did until recently. –  Tim Howland May 9 '09 at 0:07
1  
Regarding IIS I believe the worker processes are not run as local system since IIS6 but as network service by default (which is a low-priv account). The complexity of IIS however is staggering considering the impersonation and user context code-execution you can achieve (good for seamlessly integrating with other systems within a company without sending clear text passwords everywhere - bad for "plain old web site serving"). So as always, chose the right tool for the right job ^^ –  Oskar Duveborn May 9 '09 at 18:37
    

is there any reason ASIDE FROM COST, that linux is more secure

Suppose you have a security hole in your system. Which system is more secure? I think the system that allows you to fix/disable the hole earlier is inherently more secure. ASIDE FROM COST, which of the two systems, Windows or Linux, allows you to fix it faster?

Let's assume you have a very, very large budget. With Microsoft, you can pay them more, and they will try to be faster. But they are only as fast as they wish.

With Linux and large budget, you can keep your own C developers. Twenty of them, two thousand, whatever suits you... They can analyze the source code (legally!), and produce the fix as fast as you wish.

share
    
And how many people keep a legion of C developers on hand to do that? Most people have to take the "free" route and wait for the developer to role out their update, windows or linux With enterprise Linux & paying for it thats no different then windows except you don't have a billion $$ software company behind it. –  SpaceManSpiff Jun 21 '09 at 11:31
    
The question was: "is there any reason ASIDE FROM COST, that linux is more secure". So here you have, a theoretical case that does not take cost into account. –  kubanczyk Jun 21 '09 at 11:35
    
-1; true, you answered the question, but it remains a theoretical case that won't apply to over 99% of installations, and has the weakness that while your C developers are working on fixing the hole, your core business isn't getting it's own work done. It also flies in the fact of the "leave security to the experts" dictum. –  Darth Satan Jun 21 '09 at 12:27
    
Let me rephrase it for you: with Linux, you can legally choose between security expert A, B, C or RedHat. With Windows, you get patches from Microsoft, period. –  kubanczyk Jun 21 '09 at 14:01

I would say that with an expert sysadmin/engineer, windows is just as viable and secure as linux. I'm tired of OS flame wars, anyone who involves them self in them simply shows that they don't understand computing.

Unfortunately there aren't many expert windows sysadmins out there. I've met a handful in twelve years that were capable. I don't mean being able to get a website up and running, I mean someone who is capable of digging deep into problems because they understand how computers work and can dig into areas like crash dump analysis. I'd also say that unix sysadmins are much more likely to have a wider field of knowledge.

share

The "Windows == bigger target" argument is actually double-edged. Because millions of Windows installations over the world are being actively attacked, it also means that Windows has more fixed security vulnerabilities than Linux does. Those legions of patches every month? They're fixes for security vulnerabilities that have been discovered. And it's not the vulnerabilities that you know that you need to worry about, it's the ones you don't know.

Aside from that I don't believe that either OS is intrinsically more secure than the other. The differences are down to the implementation, how it's used, and the other security-related scaffolding that exists around it. A Linux box with a root password of "password", no firewall, and connected directly to the internet won't be secure, despite it being Linux.

share

A competent set of admins can run Windows or Unix servers securely. Less competent admins will have security holes regardless of OS. That being said, the two problems I have with Windows as a server platform are

  1. It's too much like a workstation. RDP is used to manage it 9 times out of 10. This encourages admins to use it like a workstation. Every Windows shop I've been in it's common practice to use IE on the server to browse the web when working on a problem on that server. The enhanced security for IE on the serer is generally turned off immediately. This is a HUGE attack surface that's almost never an issue on a Unix server. This is something that can be taken care of by better policies, but it's not something you have to worry about on a Unix server.

  2. The privilege system is opaque and hard to understand. While it's very powerful, it's often not clear exactly which permissions you need for certain actions. This very often leads to admins throwing up their hands and granting administrator privileges to an account in order to get the job done.

share

Not the answer you're looking for? Browse other questions tagged or ask your own question.