Hacker News Reader

Comment by nonrandomstring | Hacker News Reader

> What’s the most secure OS for servers? Why?

The one you built yourself with a kernel stripped down to a TCP stack and a few essentials, a bare userspace and bootloader, and just enough libc to support whatever you're serving.

Why? Minimal attack surface.

Why not? Most people won't spend the time to learn OS/distro building. It's a steep curve, maybe one or two years to master building a minimal viable OS with just a kernel and shell, doing something like Linux From Scratch [1] or similar [2], and then learning the ins and outs of (dpkg-tools/debconf type or similar) source package management way to roll your own bare-bones.

[1] https://linuxfromscratch.org/

[2] https://flylib.com/books/en/2.605.1.108/1/

View on HN

Adding to this with some applicable guidance whether it's Linux or BSD.

The most secure OS would be one where you have an understanding of all it's security configuration options, have those things configured, and verify that configuration on a regular basis. With Unix-like operating systems you have the advantage of many of these things being controlled via text-based files, so you can version-control these and detect deviations of the configuration.

It also worth mentioning that the most secure OS would be supported by a network architecture that isolates it reasonably well. Firewalled subnets using the concept of Zero Trust are valuable.

On the application side, ensure whatever is running on these servers is minimal. Complexity can mean vulnerability, whether it be from the application itself or it's build dependencies. Minimalism is another strength Unix-like operating systems can deliver.

Why not build your own distro with NixOS?

It seems to have all these upsides combined with a domain-based configuration that makes the configuration of what you need, whatever you need, quite easy, at least for the well-traveled paths.

And it's powerful enough that when you learn the language (which is small) and the necessary builtin functions (of which there are many, but there's a huge body of existing work that makes it easy to find examples) you can customize your system to your heart's desire.

> Why not? Most people won't spend the time to learn OS/distro building.

I don’t know how good they are and have never used any, but there’s tooling for building the ultimate stripped down kernel, unikernels (https://en.wikipedia.org/wiki/Unikernel)

A quick Google gives me https://nanovms.com/, https://github.com/solo-io/unik and https://github.com/rumpkernel/rumprun.

A disadvantage of such a stripped down system is that debugging such a system can be difficult. For example, if there’s only one process, you can’t open a shell to look around on a misbehaving system.

That seems like a great starting place.

The various Nix recommendations also appear to be in the same spirit of essentially starting from scratch.

Reply on news.ycombinator.com