Web server - Ubuntu server (lamp) or Vista+IIS7?

BigEejit

I am experimenting with setting up a webserver/family forum/* server and because it is likely to be on all the time I thought I better get the security right.

I have started with playing with Ubuntu server in a vmware virtual machine and selected Server and Lamp during install. I quickly ran into trouble trying to get things done due to it being text only and me being not having touched linux/unix for 5 years so I installed kubuntu desktop (can uninstall or more likely purge it later after everything is up and running). Ubuntu without a gui is no doubt secure but for someone who is not a text based linux user its tough going. I am worried that further down the line keeping the thing up to date may fall over if "sudo apt-get update" or upgrade doesnt work for some reason it will be a pain in the proverbials getting it sorted.

I read in several places that FreeBSD is even more secure and is used where high availability is important but also harder to configure and to make it secure, so while I downloaded the latest distro for my amd based box, i wont be in a rush to install it :P

The other option I am looking at is Windows Vista + IIS7. Upatched Vista is insecure, but patched and with a decent antivirus (avast) and firewall (online armour) and with the annoying UAC turned on it should be pretty secure, IIS7 is only showing one patched vulnerability on secunia (versus 1 unpatched for apache v1.3, 4 for v2.0 and 2 for v2.2).
Also I tried Vista media centre and liked that (and so did the wife, WAF is high there) so I am kind of leaning towards a solution with Vista plus IIS7 or Vista plus Ubuntu LAMP running in a virtual machine.

I've had a search for pro's and cons and when it is brought up on forums or blogs attracts these polarised (and sometimes quite abusive) views of the linux versus windows camps. So I'd prefer if the discussion didnt go down that route. What I am looking for is people who are using or used Ubuntu 9.04 LAMP and their experiences and I'd also like to hear about Vista plus IIS7. Mostly I'd like to hear of novices experiences, its all well and good for someone who has used linux for 10 years to lock down everything easily, its quite another proposition for a newbie like me to do it.

Martyr

i'd recommend fbsd/mysql/php but its all about what you're comfortable working with

don't forget suhosin for php

RoadKillTs

Well I'd like to say FBSD but id be more comfortable with Ubuntu.

dr strangelove

have a look at this:
http://nanotux.com/blog/the-ultimate-server/

lighttpd on ubuntu, supposed to be pretty good.

I use it myself and have never had any problems.

drim3r

Vista for a web server??? naaaahhh... Better WinXP.
Ubuntu is the best.

JimmyCrackCorn!

Doesnt matter unless you worry about the number of conucrrent connections it can handle.

e.g half open sockets.


From a security point of view either can be secured just fine

BigEejit

Thanks for the votes guys .... I am farting around with ubuntu and getting used to linux again, lots of googling LOTS :pac:

Really want to get an OS that does it all though... thinking of mythbuntu with apache, DB and python/perl/php. Have to get it all up and working and then check to see if the wife can handle it or even actually likes it :rolleyes:


/actually I voted vista because I am using Vmware and testing the different os's etc in virtual machines where possible.

ntlbell

Surprised to see FreeBSD mentioned and not OpenBSD

bushy...

Few things here to get you started , almost ready to go

http://www.tdisecurity.com/iso/OAMP.zip

http://www.fosstools.org/

Thomas_S_Hunterson

Will Vista be fully remotely managable via SSH? Will you have to learn a whole new set of commands to do it?

glimmerman54

Ubuntu has probably the best user based support forum in the worldhttp://ubuntuforums.org/

As web servers go Linux rules that is all.

Are you looking to set-up a web server running on your LAN / Internet?

If you like Linux but cant handle the lack of a GUI you could always add webmin http://onlyubuntu.blogspot.com/2007/05/how-to-install-webmin-in-ubuntu.html which will add a GUI interface accessible through the web, Although this will expose a security risk its really a usability to work balance.

If your a little bit new to Linux or need a refresh this guide is pretty good http://www.ubuntupocketguide.com/download_main.html

Are you planning on running a headless server ie with out a monitor?
How to you plan to administrate and access the server FTP, SSH, Keyboard Monitor?

Also are you planning to deploy any CMS like Joomla, Drupal etc?

Vista as a web server? sure it might be the most secure OS Microsoft ever brought out. But its going to be a huge demand on resources 2GB for basic operation plus the costs involved vs an Ubuntu server on 256 mb ram on a an old P3 its practically a no brainer.