Important: I'm not trying to ask here if indeed RHEL is more secure than Ubuntu. This is not an "opinion" question.

Rather, I'm asking, if someone makes the above argument, how would you prove or refute that? I looked at CVE databases but they are full of vulnerabilities in packages, not operating systems. I've compared "hardening" documentation and both operating systems have means of hardening them to a seemingly similar level.

Also, I looked at how popular each OS is - for web servers, in AWS, etc. But what point does that make?

So, how would you deal with this argument?

  • 1
    If somebody makes a statement of fact, it is up to them to back up that statement. It's not up to you to refute it. Ask for specifics as to why they made that statement in the first place. – doneal24 May 24 at 17:32
  • Unfortunately, that person is a customer, who is always right :) So I'm trying to do that work for them. – yi1 May 24 at 17:32
  • 2
    First, you ask them for clarification. – Michael Hampton May 24 at 17:36
  • 1
    If they're hiring you for your expertise then be confident in saying there are pros and cons for each distribution. – doneal24 May 24 at 17:37

The ultimate question is not exactly the OS itself, but how the OS is configured. Both OS's can be setup securely, or they can be setup like Swiss cheese.

While both OS's are arguably as secure as the other, what I would look at is the following:

  1. Segmentation and other security tools: For DAC, Ubuntu uses Apparmor while RHEL uses SELinux. RHEL also comes with Auditd out of the box, whereas Ubuntu needs it to be manually setup (and runs an older version). But these type of tools only have value if you use and monitor them.
  2. What are the out of box settings (and this depends on the source of the OS: ISO/AMI/etc.) - does one OS have better controls setup for SSH access and firewalls? Does one have a bunch of listening services? While both can be roughly configured to match the other, starting with a default secure install versus having to track down a bunch of edge services reduces the risk of missing something.
  3. What is the track record for handling CVE's? How quickly did the parent companies respond when large issues occurred, such as Heartbleed and Shellshock? Which company's response aligns best with your risk mitigation strategy?
  4. Which OS has the best patch management system for your needs? An OS doesn't stay secure if it's not kept up to date.
  5. What does their support lifecycle look like? Do you plan on tracking the latest version and constantly cycle machines, or is this a pet machine that will need support for a decade?

These are just a few ideas for differences to look at - but it is by no means comprehensive (if anyone has any other ideas, I'm happy to expand the list above).

  • Thank you. Regarding track record for handling CVE's, here's an interesting analysis: pdfs.semanticscholar.org/4f78/… – yi1 May 24 at 21:12
  • On point #5 - Ubuntu has LTS, which is five years support, whereas RHEL has 10 years' support. – yi1 May 24 at 21:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.