Replies

Great, kids. The moral of the story is if you turn off EVERYTHING, you don't have to patch your box.

No, genius. The point is that you turn off what you don't need and configure it so that it is secure as possible. We probably have around ten different network daemons running on them at any given moment on average. Nonetheless, the OS has not needed to be patched and only one of the myriad of daemons that we run had to be patched. These boxes do most everything that a normal Unix server does plus some extra things most Unix servers do not. They have simply been trouble free for the most part and no security vulnerabilities have been published for the various applications we use (excepting the one).

The point is that you turn off what you don't need and configure it so that it is secure as possible.

I can do the same thing with IE and IIS and Outlook and whatever. I can also use the built-in IP filtering to enable/disable any ports that I want. And doing so obviates the need to patch the damned box. Geezus, you geniuses would think this is impossible ...