5

I am on the Debian Security Mailing list, and recently there has been a lot of traffic going back and forth about the security (particularly package updates) of Ubuntu vs Debian stable. A guy on the lists asked this:

I'm a new user of the great Debian distro for my Desktop. But when I talked to a friend and I told him, that I'm using Debian (Wheezy) for my desktop computer, he told me that I shoudn't use it because it is not secure. He told me to use Ubuntu instead. He explained that with the fact, that Ubuntu has more security features enabled than Debian (also more compiler flags for security) in a fresh install. He gave me a link to the following site:

https://wiki.ubuntu.com/Security/Features

So, I'm very happy with Debian but because my friend seems to be an expert for Linux, I don't know if I can use Debian. Can you tell me which of the security features promoted by Ubuntu are also enabled in Debian?

I was wondering if anyone had their two bits to add...

3
  • Ubuntu already implements all of the features you mentioned, and the page you link is an excellent guide to these. Debian has adopted a number of these security features now, but to keep such a list up to date, surely the right place to ask is a Debian experts site, rather than askubuntu.com? May 19, 2014 at 14:50
  • 3
    This might be a better fit for unix.stackexchange.com May 19, 2014 at 14:55
  • @JorgeCastro It might be... May 19, 2014 at 15:01

1 Answer 1

4

I think first off it's good to remember that a system is only as secure as it's user.

Quoting Joel Rees (In reply to that very question) here:

Security is not a package you can buy or download. Whether you choose Ubuntu or Debian, if you are concerned about security, you need to spend time learning about it The partly out-of-date pages that Riku gave you links to are a good place to start.

The first question I would ask (but don't answer me, of course) is how good your passwords are. This will be an issue with any OS you choose, even seriously secure OSses like openBSD.

Your passwords should be at least ten characters, preferably twelve or more, include alphabet and numbers and one or two punctuation marks. One I used to use was something like "MI

The next question is whether you allow root login. (Again, don't answer me, on or off list. Just check yourself.) If you allow root login at all, use an extra strong password for root. You probably do not want to allow root login from the network, but you may want to allow root login from the console.

Changing the port sshd listens to is also a good idea.

Do not surf the web as root or as any administrator login id, of course.

Speaking of admin login ids, it's a good idea to have one non-root login id that you only use for administrative tasks. And you should avoid getting onto the web when logged in with the admin id. Which means you need another id for general use, which makes two strong passwords, three if you allow root login.

If you have a habit of downloading random apps from the internet, unlearn that habit. Use your package manager instead, and think twice or more about the apps that you can't get through your package manager.

Anyway, the basics of security are the same, whether you use Debian, Ubuntu, Fedora, openBSD, whatever.

Bottom line: I don't believe a secure user will have much more trouble with one than the other.

3
  • 1
    Quoting Douglas Adams "a common mistake that people make when trying to design something completely foolproof is to underestimate the ingenuity of complete fools.". The same seems to apply for insecure users. May 19, 2014 at 15:21
  • A link to the mail is much appreciated ;)
    – Braiam
    May 19, 2014 at 23:52
  • @Braim sorry, I should have thought about that sooner. Also added in edit. lists.debian.org/msg00018.html May 19, 2014 at 23:56

Not the answer you're looking for? Browse other questions tagged .