Server security (was "CMS Using IIS Authentication")

At +1000Thursday 6/17/04 10:17 AM, Ben Noblet wrote:

> > Everyone, please remember that the term "IIS  .  .  .  security"
> > is an oxymoron. You should consider using Apache or another
> > open source web server instead.
>
>Ahh it's Mr One Eye again.  Your response does not help the poster at all.

         Informing him that IIS is not secure does not help him? Are you sure?

>Why is it that people like you are convinced of the absolute infallability
>of all Open Source software?

         I never stated that _some_ open source software (OSS) contains no 
security vulnerabilities (SV's), much less that _all_ OSS contains no SV's. 
As far as I know, the only significant, open source server that has never 
contained a SV (or, at any rate, none that we know of) is Qmail, an email 
server. Other software by Dan Bernstein may be similarly free of known 
SV's, but I do not know for sure.

>There have been at least a dozen security flaws found in Apache 2 over the
>last couple of years (and many in 1.3 before it) ...

         Right. And they were discovered (and patched) all the more quickly 
precisely because Apache is OSS. With IIS, Micro$oft (M$) follows the 
"security-through-obscurity" (STO) approach. M$ does not release its source 
code, hoping that refraining from such release will make it harder for 
others to find SV's. I believe that it is, indeed, much harder to find SV's 
in proprietary software (because you cannot examine the source code), but, 
as M$ is discovering, those SV's are often found sooner or later. 
Furthermore, and much more importantly, "black hats" often discover the M$ 
SV's well before the "white hats" do, which is precisely the opposite of 
what usually happens with OSS. If you are a software maker, you want the 
"white hats" to find the SV's (in your software) first, well before the 
black hats.

         Ask any security expert whether STO is a good approach.

>http://www.apacheweek.com/features/security-20
>
>The bottom line is - *all* public facing software, open source or
>commercial, requires skilled administrators to install, maintain and patch
>it on a regular basis.  Period.

         Agreed. And it is _much_ easier to maintain a server running on 
Debian Linux than it is to maintain nearly any M$ server, especially M$ 
Exchange, whose security record is even worse than that of IIS. Many 
administrators of M$ servers do not even bother to apply the security 
patches because the patches often cause some important feature of the 
server to cease functioning -- and the functioning is not necessarily 
restored when the patch is uninstalled and removed.

-- Paul Bain