Hello all! I'm looking for some help deciding which distro to use for a web server I am putting together. The server will be using Apache, mysql, php, phpmyadmin (though I may just run that on another machine and connect to the web server), and whatever other stuff I find out that I need. It is for a small business and shouldn't have to push out very much data (though that may change in the future).

My main concern is security. I would like it to be as maintenance free and secure as possible (dreaming?). There will be sensitive data on the machine and I don't really know what I need to do to ensure that it remains secure. Are there other security applications I need to install? ports I need to close/open? or do I just need to keep the OS up to date? Will Linux update itself automatically without requiring an restart?

I use CentOS at work but haven't had that much experience with it so I am still very much a newbie and didn't install it on the machine so I have no experience installing it. However, it is the OS that I have the most experience with and was planning on using that. Is CentOS a good way to go? Any other suggestions?

Thanks before-hand for the help and let me know if I need to provide more information.

Red Hat or CentOS. Debian is also a decent choice. If you have the skills I'd recommend giving Arch a try.

NOT Ubuntu or its derivatives.

I forgot to mention that this server will be manager remotely though SSH and since it will be a web server will be running 24 hours a day (obviously). Don't know if that info makes any difference but I wanted to mention it.

Yeah, go for red hat. Most server OS come with sshd preinstalled.

I probably DON'T have the skills. Am I mistaken that Red Hat costs money? or is it free? Not that that is one of my requirements or anything but would there be a reason to go with Red Hat over CentOS (assuming I can get all the support I need from the net)?

CentOS is a perfectly sound choice. It's a free edition of Red Hat Enterprise Linux, so CentOS experience should be transferrable to RHEL, and if you decide you want commercial support you could migrate from CentOS to RHEL fairly easily.

Debian would be the other recommendation, but it's best to stick with what you know.

Ubuntu is gaining popularity for servers. For a server you would almost certainly want to use the Long Term Support ('LTS') edition, currently Ubuntu 8.04 Hardy Heron.

Security is a complex issue, and one that will take you some degree of study to understand. (I claim little understanding of security of Linux systems.)

Nevermind...after a quick search it looks like Red Hat Enterprise is what costs money for the support but free distros do exist. So is Red Hat just more user friendly over CentOS? Is that why people are suggesting it?

I wouldn't recommend Ubuntu. One thing I've learned in my line of work is desktop OS stinks at being server OS. Look at Windows Server.

Granted Ubuntu makes it EASY... but I'd sacrifice ease of setup for a solid server.

As for security... I have a few recommendations.

1. ClamAV. Especially best when you're also running mail on the server. Protects Windows users from viruses.

2. IpTables. Use it. Use it use it use it use it use it use it use it use it. Learn it if you have to.

3. If you're willing to learn it and have to time: SELinux. Its biggest drawback is that it is a pain in the rear to set up, configure, and use. But it is an excellent MAC system. Alternatives could be Tomoyo and AppArmor.

4. KEEP THAT SERVER UP TO DATE! ALWAYS run the latest kernel available to you.

Man, this community is great! Such quick responses. I will definitely look into everything you suggested. Just out of curiosity, what is it about Ubuntu that you dislike for a web server? Is it just that it takes up more resources because of the fact that it is a desktop OS?

Red Hat Enterprise Linux is a commercial distribution by Red Hat. Red Hat makes the source code to RHEL freely available (in compliance with the GPL, the software license that governs distribution of much of the code). The CentOS team then remove the Red Hat branding (because it's trademarked by Red Hat) and compile the sources into a compatible distribution, CentOS.

RHEL isn't of itself more user friendly than CentOS, but if you pay the money for RHEL then you can get technical support from Red Hat, by web or telephone depending on which option you choose. However, RHEL isn't cheap - it's an enterprise product aimed at business and prices start from 350 dollars. Whether or not that's worth it is a business decision, not a technical one.

Great info, thanks! I think I'll go with CentOS after listening to everyones input and reading a little more. One more question, should I try to look for a package with php, ssh, apache, and mysql already installed (if that even exists) or just grab the latest CentOS and install all that stuff separately? Keep in mind, I'm pretty new to everything and installing a DB in Linux seems kinda scary to me.

Not scary at all!

CentOS has an "Add/Remove Programs" utility (or something very similar) in the Applications menu, on the desktop (after you get it installed, of course ).

From there, it's as simple as checking a box, and clicking a confirmation button!

I have always used linux in production servers however recently switched to solaris just for giggles and find it to be AWESOME. The ZFS file system is incredible and the glassfish web stack makes building a SAMP server a dream. Of course security is on point. Just food for thought.

Regards,
JKZfixme

Well...If I were you...I would choose between Debian,CentOS,FreeBSD,OpenBSD

I was kinda under the impression that I would not have a desktop GUI if I was installing CentOS. Do I have a choice? Is there a reason to or not to install the GUI version? I will be managing remotely so obviously the GUI would be of no use then but I will have the box physically when installing and if a GUI would make things easier installing and there aren't any disadvantages to having the GUI then why not? I'm confused.