Originally Posted by Orange Sunshine (Post 3744436)

Hello all! I'm looking for some help deciding which distro to use for a web server I am putting together. The server will be using Apache, mysql, php, phpmyadmin (though I may just run that on another machine and connect to the web server), and whatever other stuff I find out that I need. It is for a small business and shouldn't have to push out very much data (though that may change in the future).

My main concern is security. I would like it to be as maintenance free and secure as possible (dreaming?). There will be sensitive data on the machine and I don't really know what I need to do to ensure that it remains secure. Are there other security applications I need to install? ports I need to close/open? or do I just need to keep the OS up to date? Will Linux update itself automatically without requiring an restart?

I use CentOS at work but haven't had that much experience with it so I am still very much a newbie and didn't install it on the machine so I have no experience installing it. However, it is the OS that I have the most experience with and was planning on using that. Is CentOS a good way to go? Any other suggestions?

Thanks before-hand for the help and let me know if I need to provide more information.

Originally Posted by Orange Sunshine (Post 3744440)

I forgot to mention that this server will be manager remotely though SSH and since it will be a web server will be running 24 hours a day (obviously). Don't know if that info makes any difference but I wanted to mention it.

Originally Posted by Yaro (Post 3744438)

Red Hat or CentOS. Debian is also a decent choice. If you have the skills I'd recommend giving Arch a try.

NOT Ubuntu or its derivatives.

Originally Posted by Orange Sunshine (Post 3744443)

I probably DON'T have the skills. Am I mistaken that Red Hat costs money? or is it free? Not that that is one of my requirements or anything but would there be a reason to go with Red Hat over CentOS (assuming I can get all the support I need from the net)?

Originally Posted by cantab (Post 3744444)

CentOS is a perfectly sound choice. It's a free edition of Red Hat Enterprise Linux, so CentOS experience should be transferrable to RHEL, and if you decide you want commercial support you could migrate from CentOS to RHEL fairly easily.

Debian would be the other recommendation, but it's best to stick with what you know.

Ubuntu is gaining popularity for servers. For a server you would almost certainly want to use the Long Term Support ('LTS') edition, currently Ubuntu 8.04 Hardy Heron.

Security is a complex issue, and one that will take you some degree of study to understand. (I claim little understanding of security of Linux systems.)

Originally Posted by Yaro (Post 3744452)

I wouldn't recommend Ubuntu. One thing I've learned in my line of work is desktop OS stinks at being server OS. Look at Windows Server.

Granted Ubuntu makes it EASY... but I'd sacrifice ease of setup for a solid server.

As for security... I have a few recommendations.

1. ClamAV. Especially best when you're also running mail on the server. Protects Windows users from viruses.

2. IpTables. Use it. Use it use it use it use it use it use it use it use it. Learn it if you have to.

3. If you're willing to learn it and have to time: SELinux. Its biggest drawback is that it is a pain in the rear to set up, configure, and use. But it is an excellent MAC system. Alternatives could be Tomoyo and AppArmor.

4. KEEP THAT SERVER UP TO DATE! ALWAYS run the latest kernel available to you.

Originally Posted by Orange Sunshine (Post 3744447)

Nevermind...after a quick search it looks like Red Hat Enterprise is what costs money for the support but free distros do exist. So is Red Hat just more user friendly over CentOS? Is that why people are suggesting it?

Originally Posted by cantab (Post 3744471)

Red Hat Enterprise Linux is a commercial distribution by Red Hat. Red Hat makes the source code to RHEL freely available (in compliance with the GPL, the software license that governs distribution of much of the code). The CentOS team then remove the Red Hat branding (because it's trademarked by Red Hat) and compile the sources into a compatible distribution, CentOS.

RHEL isn't of itself more user friendly than CentOS, but if you pay the money for RHEL then you can get technical support from Red Hat, by web or telephone depending on which option you choose. However, RHEL isn't cheap - it's an enterprise product aimed at business and prices start from 350 dollars. Whether or not that's worth it is a business decision, not a technical one.

Originally Posted by indienick (Post 3744505)

Not scary at all!

CentOS has an "Add/Remove Programs" utility (or something very similar) in the Applications menu, on the desktop (after you get it installed, of course ;)).

From there, it's as simple as checking a box, and clicking a confirmation button!

Originally Posted by Orange Sunshine (Post 3744460)

...Just out of curiosity, what is it about Ubuntu that you dislike for a web server? Is it just that it takes up more resources because of the fact that it is a desktop OS?

Originally Posted by r3sistance (Post 3744698)

You don't need GUI for CentOS, personally I only use a vnc desktop for none administrative things. To add or remove programs the YUM (yellowdog Updater, Modifier) can be used. I suspect the GUI tool is just an interface for YUM.

A GUI uses more resources, personally I don't use GUI's other then vncserver for some casual activities now and then. You can disable a GUI post installation, you can also do installation via the GUI installer but not install any GUI facilities. Personally unless LVM is involved I use the text based installer... probably just from being so use to using it.

Originally Posted by salasi (Post 3744699)

well, I can't speak for anyone else but...

A definite 'gotcha' with Ubuntu is that it has the nasty habit of running services automatically when you install them. Most distros think that you should make a decision to run a service even though you have installed it, and this seems safer (you might not have configured the service as you like at that point, or, as I did once, only installed it to get a look at the man page).

Of course, when you know this is going to happen, it is not so much of a problem, but it only has to get you once in a big way...

The 'no root' model used by Ubuntu always seems a bit dubious for me in a non-desktop application, but isn't necessarily that dangerous.

In general, the friendly Ubuntu model, provided that you don't use a GUI, use their server kernel, use an LTS edition, probably is workable, but I couldn't describe it as the most appropriate for a professional server (probably different for a home server and if you already have Ubuntu experience) when there are good choices available.

You can get distros specifically intended for Lamp stack applications (SLAMM?), but you are worrying about the wrong problem. For practically every modern distro, installing common packages is a snap. There is a package installer. You tell it you want the package. It does it, including getting any libraries that are needed. Where is the problem?

Well, to answer my own rhetorical question, the problem is that this installs the package, but does not configure it, necessarily. Configuring packages, particularly if there is a security impact, is the bit that might cause head-scratching, but that's always the way, isn't it?

Yes, you are dreaming. When bugs show up, as they will, in the apps that you use, you will need to grab the updates and do it quickly. Fortunately, this is easy, but you can't ignore it. Unfortunately, that may mean that you need to re-test stuff if it is, eg, your database app, and an upgrade has the possibility of breaking things.


Be very very careful with anything facing a threat (the internet and maybe also your own net, depending). Firewalls have been mentioned (which is good) but you shouldn't install unnecessary stuff (anything you don't have won't be listening on any port).

Part of this is about the structure of the network (do you have a DMZ?) and that hasn't been discussed.

Not 'automagically' but its a simple process. Usually only kernel changes need a re-boot, although there is even an app (ksplice) to deal with that. However, if you don't have some kind of test server somewhere, which may also be your desktop, you'll always be taking a leap in the dark with some updates.

If, by secure you mean that you don't want it to be corrupted, that sounds like a backup. If you mean that you are storing the secrets of three letter agencies and you don't want people to access it, you are way beyond my pay grade... Way, way, way beyond my pay grade.

You could do worse than read this:
http://www.cyberciti.biz/tips/linux-security.html which is probably as good coverage of the basics as I have seen.

Originally Posted by Orange Sunshine (Post 3744617)

I was kinda under the impression that I would not have a desktop GUI if I was installing CentOS. Do I have a choice? Is there a reason to or not to install the GUI version? I will be managing remotely so obviously the GUI would be of no use then but I will have the box physically when installing and if a GUI would make things easier installing and there aren't any disadvantages to having the GUI then why not? I'm confused.

Originally Posted by r3sistance (Post 3744818)

As far as Ubuntu server, I can't understand why anybody would use it over Debian in the first place...

Originally Posted by r3sistance (Post 3744818)

and worst of all, their love of the most horrid UI colour scheme I have ever seen... why so much Orange in the default settings, even RHEL's Red interface seems better then that...

Originally Posted by r3sistance (Post 3744818)

I think you misunderstood that point, what salasi was saying is when you say, install mysqld, Ubuntu will make it active/started from the get-go... not sure if that one is true but that's how I read it. So when you apt-get anything, other distributions give you the chance to pre-configure the service before actually starting it, it can be a security flaw to automatically start services without the ability to preconfigure.