Debian vs. FreeBSD as a Web Serving Platform, Part 2

In Part 1 of this article we looked at general differences between Debian GNU/Linux and FreeBSD from the point of view of a system administrator maintaining a web server. In the second part, we'll investigate the security aspects of each operating system and briefly look at some issues requiring consideration when migrating applications and scripts between Linux and BSD.

In this age of increasing Internet vandalism, it is vital that system administrators keep close eyes on vulnerabilities discovered in any of the software packages deployed on their servers. Luckily, both Debian and FreeBSD have developed solid infrastructures for keeping their operating systems patched and/or updated in a speedy manner whenever a security problem arises. However, the two differ radically in the way they implement these security updates. This is probably one area that will have the greatest weight on a system administrator's decision to choose an operating system, so let's get it out right away: keeping a Debian installation up-to-date with respect to security patches is extremely simple, straightforward, and well-established. On the other hand, keeping FreeBSD up-to-date is a complex issue involving many steps. While this might sound like a discouraging remark, there are certain advantages to the FreeBSD approach. We'll investigate these in the next few paragraphs.

A stable Debian release has a security team which is normally very fast in issuing security advisories and releasing patches to fix known vulnerabilities. System administrators running Debian systems can subscribe to the debian-security-announce mailing list, then every time a security advisory is announced on the list, a simple "apt-get update && apt-get upgrade" will patch all known security holes in the system. This is a simple, well-proven method that has worked for Debian for many years. It can even be automated so that patches are applied automatically (with a custom script or with cron-apt) on a daily basis, although many users prefer to oversee these updates, just in case something needs extra attention. It is important to realize that in a stable Debian branch, a package with a security problem is almost never upgraded to a later versions to fix the problem; instead, the existing version is patched to fix the vulnerable code. Apart from that, there is little else that needs to be said here. Because of the power of apt-get, combined with fast work of the Debian security team, it is extremely easy to maintain a Debian system that is free of security problems. This is perhaps the strongest case for using Debian stable as a web server.

Things are quite a bit more involved in FreeBSD. But before we get into the details, let's make one thing clear - an observation that may not be immediately apparent to a user who has been using a Linux distribution for a while and who is now looking to migrate to one of the BSD operating systems. As already mentioned in the first part of this article, FreeBSD consist of two independently maintained layers: a base system (commonly referred to as the "kernel and userland") and additional applications (or "ports" in BSD speak). This separation of the base system and applications has its advantages - as an example, administrators who are still running the legacy 4.x FreeBSD systems can install the latest versions of most applications without having to upgrade to the newer FreeBSD 5.x series. On the negative side, this separation means that they need to pay attention to security issues on two fronts - in the base system, and in any of the installed ports. These can be handled in several different ways, but BSD's "cvsup", with a combination of another automation tool, is probably the most common method in use.

First let's take a look at the base system. All administrators running FreeBSD should subscribe to the freebsd-security-notifications mailing list to keep informed about any security advisories issued by the FreeBSD project. This list is strictly limited to security issues found in the FreeBSD base system, never in the ports. As such, it is a low-volume list - in 2004 there were only 17 security advisories published on this list (in contrast, the Debian security team published a total of 228 security advisories during the same period).

Once system administrators receive a security advisory, they have three options. The first one (and the easiest) is to download and install the updated binary userland package or kernel. While this is generally a simple task, it is only relevant to systems running the FreeBSD GENERIC kernel and userland. In practice, however, most administrators will probably run a modified kernel and therefore will need to use one of the alternative update methods. The second option is manual patching; this involves downloading the patch, verifying the GPG signature, applying the patch, then recompiling the userland (or a part of it), kernel, or both. The third option is probably the most widely used - by tracking the security branch of a FreeBSD release, system administrators can use the cvsup tool to update their userland and kernel after each security advisory, then recompile both (if necessary), and reboot the system.

As for security issues in FreeBSD ports, probably the easiest way to keep informed about the potential vulnerabilities in any of the installed ports is with the "portaudit" tool. Portaudit uses the Vulnerability and eXposure Markup Language, an XML application for documenting security issues in a software package collection. Once installed, it will scan for security vulnerabilities once per day and report any problems as part of the FreeBSD's daily security report. When vulnerabilities are found, the administrator has a choice of either applying binary updates, or downloading updated ports and recompiling them on the system. Again, the former option is only relevant to vanilla systems and is rarely used in practice. Compiling ports, however, can be time-consuming; it involves updating the local ports tree with cvsup, then checking a relevant text file for potential caveats, before running the usual 'make install' command. Some packages might need manual intervention, while others might require that their dependencies be recompiled as well. To make the task of upgrading ports less tedious, many system administrators prefer to use "portupgrade", probably the best tool for this task. Nevertheless, even with portupgrade, manual intervention is often needed. It is worth mentioning that, besides cvsup, a new tool, called "portsnap" is gaining increasing acceptance among FreeBSD users.

An important consideration arises where administrators run mixed-OS environments, or decide to migrate custom applications and scripts from Linux to FreeBSD and vice versa. While most general-language scripts written in Perl or Python will work equally well on both system, shell scripts will often not. This is because most Linux distributions use GNU utilities, while BSD operating systems have developed their own shell utilities with arguments and switches that often differ from the GNU ones. A good case in point is "sed", which is part of the FreeBSD userland and which sometimes behaves differently from GNU sed. That said, GNU sed is available in FreeBSD as a port called "gsed", so something like 's/sed/gsed/g' might come handy to convert scripts between the two systems. Other shell scripts might need manual update - even commands like "date" or "stat" behave differently under the two operating systems.

Given the above analysis, it is clear that Debian GNU/Linux is a system administrator's dream come true. It is stable, secure, and extremely easy to maintain. Its main disadvantage is that stable releases are increasingly few and far between, so a Debian system tends to get out of date. If this is unacceptable, administrators have an option to install newer packages from third-party repositories or perhaps upgrade to one of the Debian-based distributions with more frequent stable releases, such as Ubuntu Linux. On the other hand, if it is desirable to keep applications up-to-date to take advantage of new features in them, FreeBSD is hard to beat. The applications in its ports tree are maintained independently of the base system and can be updated regularly with relative ease. On the negative side, maintaining a FreeBSD system and keeping it up-to-date with security and bug-fix updates is a complex and time-consuming task, sometimes requiring hours of compiling software.

---

(Log in to post comments)