Re: How secure is RedHat 7.1 + updates?

Chris de Vidal wrote:
> We have a product that _requires_ RedHat 7.1.  The
> dillemma is it will be using PostgreSQL, Apache with
> SSL, and OpenSSH on an internet-facing server (through
> a firewall).  I'd be more comfortable using RedHat 9
> but we don't have that luxury here.
> 
> If we apply all updates, will it be as secure as
> RedHat 9?  I know it has older applications, but
> RedHat does a pretty good job of patching older stuff.
>  I have seen changelog bugfixes/patches on older
> versions of PHP, for example, that make it as secure
> as the latest version, even if the version number is a
> few digits behind.
> 
> The alternative is to install Windows 2000
> ::shudder::, which has a significantly longer span of
> support.
> 
> According to one security expert I know, it is as
> secure.  I just wanted your second opinion before we
> continue.

In my opinion, as a non-security expert, I believe that it is as secure. 
  Keep it up2date and you should be _relatively_ secure.

> P.S. RedHat sure did complicate things by cutting
> short support.  I understand why but I'm not very
> happy about it.  Oh, well, they didn't ask me (:

Yes, they did make things more complicated.  On the bright side, whoever 
made the software that must run on 7.1 will probably migrate it to RHEL, 
and you will have a much longer release cycle, and longer support.

Forrest
--