"What OS is right for me?" - My thoughts to that question

Greetings,

Many times throughout my security years of both teaching and learning, I find that at least once every few months someone asks me "What Operating system is the best?" or "What Operating System is better/more secure/less secure/faster/cooler/easier to hack with". To each I've given the same answer and thoughts that I shall share here, as I merely feel it is time to do so. Do not expect a list of Operating Systems, nor expect biased opinions in this post. I want to offer insight to one of the most valuable peices of wisdom one can have in the security buisness.

The answer to the question of "What Operating system is the best?" is quite simple:

Each and every Operating System is capable of preforming and responding just as well as the next.

That's correct. Now, set aside differences, stereotypes, and your past knowledge for a moment, please. And allow me to share my thoughts with you. Here is a quote I want you to never forget, something that I have never forgotten once my mentor taught me: The OS is only as good as the Admin, and the OS can never make up for a bad admin. A veteran of a Windows Operating System can lock up any windows distro in a heartbeat, more secure than an SElinux kernel on OpenBSD running tripwire, by using their knowledge and experience of windows. A newbie of OpenBSD, however, can make it as insecure as an unfirewalled, unupdated, windows 95 distrobution. Think about this for a second, if you will for me. An Operating System can have all sorts of default safeguards and built in security functions, plus unlimited tools at the admins disposal to secure it with. But, if the admin is not familiar with that Operating System, whichever one he is using, then it is all useless to him.

There is an old adagio: "A firewall is no good if you do not know how to configure it and read the logfiles"

It holds true to Operating System security, upkeep, and usage. While so many people may argue about "LINUX IS TEH GOD!!!111 windows is INSECURE omfg!!!11FIVE" and about "LINUX IS 31337 :P yuh rght", they are forgetting how important it is to learn and master both. A good security admin doesn't just brag and become a fanboy about their OS, they dig deep into the core of it to discover how they can tweak and modify it in each and every way, so that when the time comes to modify it, they already know how. Be it mastering the Registry in Windows, which by the way is actually every single module configuration that directly links into the Windows kernel at your finger tips. Or be it learning how to use KDE, even if your past experience with it was shotty. Why is it so important to focus deeply onto your OS of choice? I'll tell you why.

When an admin is comfortable with their OS, they can begin to actually learn. Thus is the root of my entire answer. Despite what OS you are on, find the one you are most comfortable with and master it. Because when you master it, nothing can penetrate you, and you are quick to both problem solving and prevention. Forget the stereotypes of Windows not being "leet enough", or Linux being only for "geeks". Find what you like best, and master it. This leaves me to the last part of my post here, dear friends.

When you have mastered an OS, truley knowing it inside and out, then move onto a new one. A completely different one. If you mastered Gentoo Linux to the bone, then give Windows XP a shot. Remember, shove aside stereotypes and previous bad experiences and use that to drive you even harder to make it WORK like it should. With equal knowledge of multiple operating systems, not only does that widen your "hire me" contract, but it helps build general knowledge about computers, period.

So I say again, and I leave you with this: Each and every OS is just as good as the next, and can do the same thing in different ways. The key and the challenge is finding the OS you are most comfortable with, blowing off the windows and linux zealots that will stereotype you, and actually learning. Remember, there isn't a single thing that Linux can do that I can't make Windows do just as good, and there isn't a single thing that Windows can do, that I can't make Linux do just as good.

Take care, be well, and do not take this as a flame war post, but as something to honestly think about, grow on, and take to heart.

kindest regards,
Pooh Sun Tzu

Well said,

Although you may not have intended it as such, I would say that this is a rather nice, succinct little tutorial?

Just my opinion

Moderators?

Cheers

Good point raised... I guess yeah a sort of Mini tutorials for the best OS....

Agreed any OS is as good as its admin....

Only diffrence is the way the manufacturers package the product...

Windows comes with lot of already open services.. I guess that has made life decent for many computer users...

Linux , Unix , open BSD come with tight compartment form of package.. It in turns gives lot of Admins a good life to live.....


Cheers....

I disagree anjali, as we can't just look at "Default securities" because if the admin doesn't know it's secure already and how, it's a waste. Windows doesn't come with as many open services as you think (I counted 3 - 4 on a default tcp probe unfirewalled), and this is equal to a default install of Redhat.

Thus we can't say Linux is more secure than Windows, or vice versa, because it isn't about the OS it is about the admin knowing what securities are in place. If someone from Redhat switches to OpenBSD and starts changing a ton of settings because they knew Redhat down pat but BSD runs differently, then BSD's default security is once again worthless. Point being, though, that defaults mean absolutley nothing in the world of security. If someone is defending their network with a default install I would call them an untrustworthy admin. Not just because it is a default install (and even OpenBSD at that), but because they would not take the time to learn the OS and take the extra steps to secure it further.

Because, in the end, they can all be just as secure with the same amount of hassel. While setting up Ipchains may take someone weeks to figure out, installing zone alarm takes them 5 minutes. Where as it may take someone a few weeks to learn how to turn off windows services, editing starting services on a linux box can take 3 minutes. It isn't about default, it's about what the OS can do in the end and what limits you can stretch it to.

Excellent answer to a very comon question. And it should be a tutorial.

Nice,
Whatever, whoever whenever, Slackware is best http:\\www.slackware.com
jks, Good tip on afta mastering onw to move on even if it is winxp lol :D

but slackware

Quote:

---

Originally posted here by anjali
Good point raised... I guess yeah a sort of Mini tutorials for the best OS....

Agreed any OS is as good as its admin....

Only diffrence is the way the manufacturers package the product...

Windows comes with lot of already open services.. I guess that has made life decent for many computer users...

Linux , Unix , open BSD come with tight compartment form of package.. It in turns gives lot of Admins a good life to live.....


Cheers....

---

Hey Hey

I'm gonna go with PST on this one and say I disagree with you. You may look at services and say "Hey a lot of stuff is running" on a windows machine, yet do you know what those services do? My DSL connection has it's own service ( that doesn't affect security in the least). Sure there are open ports, but that's why the first thing an admin does is lock down the box (a good admin anyways).

If you look through the newsletters, one of them.. I'm not sure which (I'm guessing 9 or 10) has an article I wrote titled the "Joys of Being Rewted". It was a mandrake 9.1 box and a fresh install. I was lazy and in less than 24 hours the box had been rooted by script kiddies. Yet I have seen Windows boxes go for months without being touched off the default install. Windows has it's share of problems... worms that affect the various services. If you install almost any Linux distro right now, I guarentee you at least one service will be vulnerable to some sort of root exploit, be it the version of ssh they use, or the samba service.

The problem is most people have experience with a single user system. They base their opinions on this and even in that one system they don't explore it. Did you know that on top of the ICF and it's stupid little check boxes in Windows, there is also TCP/UDP/ICMP packet filtering? Have you ever experienced the power of AD, especially group policy editor?

I may seem biased here, but I run both systems on a daily basis and I troubleshoot both systems on a daily basis. Both systems have their advantages and disadvantages. If you really want to compare things and you mentioned the way OSs are packaged. This can be a big disadvantage for admins. People install a linux disto and say "Wow look at how many tools it comes with" most of those tools are third party tools, they are Linux itself they are addons. Now take a windows box. It contains very few third party tools (sure there's a folder on the CD but it's fairly empty). To gather a lot of the same functionality on Windows you have to download outside tools and install them. This is especially true at the console more than anywhere else.

Let's say I take over for a lazy admin and we'll run through both scenerios.

Windows:

He hasn't done anything to secure the system or installed any third party apps other than an application based firewall because they're easily installed. That in itself is leaving the system fairly secure from and outside point of view. I tweak the firewall settings, disable unnecessary services (very easy with the services mmc) and use group policy editor to lock down the accounts quickly. Maybe run spybot to remove spyware and use the system startup to see what's starting on boot (or msconfig for the purists)

Linux:

He hasn't done anything and didn't wanna learrn iptables so it isn't even firewalled. The odds are the system has already been rooted because he did a shitty install (clicked the select everything option) and there are many services running. I have to search for a break-in and if so the odds are my system may as well be reinstalled, which means I have to set-up everything myself but at least it'll be done right. If I find nothing to point to a successfully hack/crack and decide to secure the system, I have to start writing iptables rules... then I have to disable services (which may be in several locations... could be in inetd.conf, could be in x.inetd, could be in rc.d, could be a cron job). Now I have a huge install with many users. I have to find out where the users are (oh look each one has their own group), now I have to start creating groups... and then I have to chgrp all the utilities in /usr/bin /usr/sbin /usr/local/bin... etc because I want to make sure they are locked down and only certain people have access to them. With the windows install I didn't have to do this because third party apps aren't installed by default.

Looks like Linux has made my life a lot harder in this case and created more work for me. You can argue there are scripts to automate everything, but that's besides the point. There are more tasks to complete on one rather than the other. With the way MS supports scripting languages now , whether you use VBS, jS or something else.... an admin can be extremely powerful and his job can be relatively easy.

You have to look a this from a network point of view instead of a stand-alone system to get the fell of what the admin's work is going to be. A single computer.. there's no difference, either one can be locked up just as tight, and is just as insecure of the install. The services running are only part of it, you also need to think about which of those services are actually a hazard and a really truly vulnerable.


Anyways I'm done,

Peace

I stand corrected.....

Thanks pooh . hertz for bringing the same to my notice.....

Good Morning All,

Threads and discussions like these are exactly why I come in here. Great knowledge base to learn from all. Even if I was only just browsing thru, I'd learn by osmosis. So keep it up folks, I know I appreciate it! :)

I don't think anybody could have said it better, pooh.......I'm speechless!

That hampster link scared the bejesus out of me 57686..

And my thanks to everyone here for the support you have all given me on this insight. Rare is it to speak such things about equality without having the flames pour down like hell and brimstone.

I have read 'The Art of War' and the writings of Pooh are the missing chapters to that great book.

Actually quite a bit of "The Art of War" are in the writings of Pooh. To be more specific, they are in the writings of "The Tao of Pooh"

http://www.amazon.com/gp/reader/0140...53#reader-link

;) Thanks for the compliment though, I did get what you meant.

I was wondering, is it possible to get into a machine (remotely) with no open ports?

If not then a default install of Gentoo (yeah! :), is not vulnerable to a remote attack.
Because there are no services running on a default, from the install manual, install.

If so then, oh well... :)

If there are no open ports then the chance of a remote hack is MUCH less likley. If you run a default gentoo installation and don't run a single service save the primary command line (yes, that means excluding x windows), then you narrow down all outside activity to nothing more than DoS(denial of service) attempts using ICMP, TCP, and UDP pings.

So, if your base question is:

If I shut off every single port on my computer, can someone hack into me *remotely*?

Then my answer is:

No. Because it is just like building a prison without doors, windows, vents, or circulation systems. There is not a single way to get in and out. You can of course knock on the walls (ICMP ping), but it certainly won't do you any good if there isn't a door to "crack"

very well addressed. my father thinks that Win is the safest OS, but this will blow his mind.

Dual-Boot is the only way for me.