The worm that didn't turn up (Guardian)

A Linux box is not inherently any more secure behind a NAT (network address translation) router than it was on a publicly routable address if you simply limit the open (listening) ports and the range of source addresses which are allowed to access specific services.

Yes there are many people who have had their Linux box "rooted." Often they haven't detected the compromise for a long time. However, I can say from long experience, that Linux has made significant improvements over the last few years. After the days of Ramen, Adore and Lion we've found that Linux worms and remotely exploitable arbitrary code and root vulnerabilities are getting to be far less common and somewhat more difficult to exploit.

As the mainstream distributions integrate more kernel hardening features (like SELinux, much as I detest its complexity; and systrace, the grsecurity patches, etc) then things should continue to improve.

Convincing the major distributors to further encourage better security with better defaults, guided installation and configuration dialogs, and some additional packages should also help.

All major distributions should ship with chkrootkit and/or rkhunter and bastille. They should default to installing and configuring them (or at least recommending them and requiring a user/admin to specifically reject them)

ssh continues to be one of the scariest vectors for possible vulnerabilities. It's ubiquitous and privileged. It would be vastly better for ssh to be more locked down by distributors' in their default configurations. I routinely configure sshd to limit the allowed source addresses (both using its own TCP wrappers entries in /etc/hosts.allow and using appropriate iptables rules). I also require that all connections have pre-shared host keys and that all users have keys (no passwords allowed). I sometimes set up specific gateways systems where I loosen these restrictions a bit; but the tighter configuration is the default.

Recently I've been seriously considering using a port-knocking configuration on systems that need to have a more open ssh daemon. This would allow any authorized user, from anywhere, just using a password --- but only after they sent the right combination of blind connection requests.

The idea of all these measures is to limit the visibility to port scanning and brute force while still permitting remote administration.

JimD

The advantage that Linux does have (don't know about MacOS) is that the underlying system architecture has been designed with security in mind,

I know it's an open question why worms are less of a problem for Linux, but I think I have to rule out security-conscious design. It can't be that because it doesn't matter how many security holes there are; one is enough. And Linux does occasionally have them. We read in LWN all the time about Linux bugs that allow someone to take over virtually everybody's Linux system, but it never happens.

Another theory of Linux's superiority is that Linux users are more likely than Windows users to apply the fixes before someone can exploit them. One fact in support of that is that, regardless of how many security flaws there are in Windows, nearly all Windows worm infections wouldn't happen if all the Windows systems were up to date (i.e. the fix was available before the infection). That makes it look like a problem of applying fixes, not of existence of bugs that need to be fixed.