dns servers -> linux or windows -> security difference

['chris']

hi

we are hosting our dns domains by nettica.com dns servers.
they are running under windows.
we have just been informed that nettica dns servers were currently being subject to a DDOS attack.
our webservers were unreachable.

is it security difference when dns servers running on windows instead of linux because of DDOS attack ?
or important is only the firewall in this case ?

kind regards
chris

[Ivan Ferreira · Accepted solution]

The "security" definition can be ambiguous. You cannot consider a Linux server more secure than a Windows server if is not monitored, protected and patched as needed.

Both can be as secure as your security practices.

I prefer Linux as DNS server because I prefer the management of servers via CLI. That allows me the access to servers remotelly even with ver low bandwith.

Also, the restore of a Linux DNS server in case of a cathastrophic failure is very simple.

Linux DNS server can run in chroot environment, a pretty nice feature for security. Virus for Linux is a little more difficult to find.

These are the reasons why I prefer Linux over Windows, but if you maintain a good security practice, you can use any of them.

[Steven E. Protter]

Shalom

A system is only as secure as its configured to be. DNS was ported from Unix to Windows and I think its a better idea to run it on Linux or Unix.

Windows servers reliability record in this area has been less impressive than Unix/Linux. This service is in general a service that gets frequent exploits. Its necessary on either platform to insure that its properly patched.

SEP

[Heironimus]

Depending on the magnitude of the DDoS it may not matter what platform you use for DNS or what kind of firewall you have. Any server or network link can be overwhelmed if you hammer it hard enough, and the nature of DDoS attacks is such that you can't simply deny a troublesome source IP.

[Alpha977]

Hello!

I think the difference is only the platform, Windows, Linux, Solaris etc etc.

I think the detter solution is OpenBSD with BIND, all behind a good firewall (like Checkpoint).
This solution i have try some years ago to a client and is still working yet.
With Windows AD and an hardware firewall i have some problems to make mail-server works.

Bye