Which is more secure Ubuntu or CentOS?

TIA

Yes.

Forrest

Depends on who's using them.

Depends on how you've set them up.

How about assuming both are reasonably hardened after installation.

Are they both administered by the same person?

All depends on the users skill to harden it. Basic idea remains same, implementation is different.

Yes.

From the bugtrac, I seem to get more reports for Ubuntu over CentOS, so I would assume CentOS might be a little more secure, is that correct?

Since the packages included in distros vary, I'm not sure that would be a good metric. That is, unless you're talking about distro-specific security vulnerabilities, which aren't very common. Maybe you could use other metrics, such as the time it takes for the distributor to release security patches. That way you could get a random sample of vulnerabilities which affected both distros and compare their response times.

Another thing you could do is set two test boxes up with those distros (fully updated), and hire someone to run a penetration test on them. Of course, as has been hinted above, the results of a penetration test wouldn't necessarily be good indicators for security problems with the distributions themselves, since they could easily be the result of poor implementation.

This may also be due to Red Hat bugs being fixed and CentOS acquiring the fixes when they get the newest version of whatever source RPM fixes the bug. Or it may be that more people are using Ubuntu and reporting problems. As win32sux says, it isn't really a good metric.

Forrest