Vlad Mazek knows his way around. “I’ve been a Linux system administrator for three years longer than I’ve been a Windows guy and work on both platforms daily.”

Vlad’s a tireless, thoroughly opinionated, advocate for Microsoft Windows Small Business Server (SBS). In case you’re wondering, SBS is Microsoft’s all-in-one package targeted at Small and Medium Business (SMB).

The basic package includes:

  • Windows Server 2003
  • Windows SharePoint
  • Exchange Server 2003
  • Microsoft Office Outlook 2003
  • Microsoft Shared Fax Service
  • Routing and Remote Access Services

For a few bucks more, you get: ISA Server 2000 firewall, SQL Server 2000 and… Microsoft Office FrontPage 2003??? Hey, we got this off Microsoft’s SBS website. Apparently, nobody memoed the SBS gang that FrontPage died.

Anyway, Vlad believes the real strengths SBS enjoys over Linux revolve around its easier upgradability, better documentation, more professional consultants and most of all, Microsoft Exchange. (Whether you agree or disagree, you’ll benefit from his colorful and insightful reasoning.)

All true, as far as he goes.

But while Vlad suggests that people buy Linux strictly for the price, a crucial disadvantage of SBS lies in that mountain of software that Microsoft’s licensing rules force you to pile onto a single server.

When a Windows-targeted virus strikes… or a Windows-focused attacker penetrates… or any software loaded onto your SBS server crashes… You may lose your whole network.

Don’t take our word for it. The Twenty Most Critical Internet Security Vulnerabilities (Updated) ~ The Experts Consensus (SANS, 28 November 2005) listed those vulnerabilities most dangerous to Windows, *nix, and both platforms. While both Windows and Linux have configuration weaknesses, the rest of the platform-specific weaknesses belong exclusively to Windows, including:

  • Windows Services: MSDTC and COM+ Service, Print Spooler Service, Plug and Play Service, Server Message Block Service, Exchange SMTP Service, Message Queuing Service, License Logging Service, WINS Service, NNTP Service, NetDDE Service and Task Scheduler;
  • Windows Libraries: Windows Graphics Rendering Engine Remote Code Execution, Microsoft DirectShow Remote Code Execution, Microsoft Color Management Module Remote Code Execution, HTML Help Remote Code Execution, Web View Remote Code Execution, Windows Shell Remote Command Execution, Windows Hyperlink Object Library Remote Code Execution, PNG Image Processing Remote Code Execution, Cursor and Icon Processing Remote Code Execution, Windows Compressed Folder Remote Code Execution, JPEG Processing Remote Code Execution.

Many of the listed dangers have been fixed. But is there any doubt that the next Top 20 list from SANS will be weighted differently?

More importantly, nearly every vulnerability that threatens a Windows server must be dealt with by a Small Business Server admin, due to the product’s All-In-Oneness.

As for the jewel in SBS’ crown, Microsoft Exchange… Many SMBs still expect a mail server to simply serve email. They tend to avoid collaboration programs they view as bloated maintenance and security headaches. Same goes for SharePoint’s group services.

Over the years, we Email Battlers have run the gamut of Zilog/Intel-based operating systems: CP/M, MS-DOS, Artisoft, Novell, Windows and Linux.

And though we’ve tried SBS and its all-in-one approach, we’ve found managing a fleet of el-cheapo single-task Linux and Windows whiteboxes is much easier. (fyi: So does Google, albeit without Windows, and on a bit grander scale.)

A Linux whitebox running only Postfix, qmail or Sendmail is relatively simple to manage. Need another mailserver? No problem. Just pull out your handy hard disk cloner. You’ll be up-and-running in less than an hour. Same goes for firewalls, fileservers, and the rest.

While it’s true that upgrades and patches can be a pain, they’re blissfully rare… especially on single-function equipment.

Documentation for mainline Linux products is usually terse, but adequate. Same goes for consultants.

Want an Exchange server? Build it as a standalone. You’ll find it’s not so bad, either.

As for those much-heralded upfront money savings you squeeze from Linux…

In the end, you’ll probably lay out more for $300 whitebox servers and the attendant backup power supplies than you would drop on a single hot-rodded SBS server.

But in return, you’ll get a network that’s so flexible, troublefree, secure and easy to manage, your biggest problem may be forgetting where you put your passwords.

It’s not for everybody… but then, neither is SBS.

Did we mention that, with Linux, you’ll never have to figure out the difference between a server license and a client access license (CAL)… a device CAL and a user CAL… how multiplexing affects licensing… what kind of CALs you can run, etc? That’s a another Windows exclusive.

Update, 9 June 2006: Vladfire Rains Down on Email Battles! After posting on this site, Vlad apparently felt we still don’t get it:

Their outright ignorance of what SBS provides not only demonstrates lack of understanding of the SBS platform but also misses the mark on the features that small businesses expect these days.

Ignorance of the SBS platform? Only if Microsoft now lets you break the individual SBS programs out onto separate SBS boxes, instead of keeping them altogether on one target… er, computer.

Otherwise, Vlad’s missing our point. We readily concede that SBS provides a virtual cornucopia of delightful and tantalizing features in one convenient package… for both users and attackers. A computer is only as secure as its weakest vulnerability allows.

Frankly, we don’t care about spanky fresh features that make networks insecure… especially when the manufacturer’s security record is considered (see above).

Vlad also notes that Sendmail has had problems of its own, and qmail, Postfix and the like are too primitive and difficult for today’s small biz that wants it all.

Again, point conceded… for the small biz that wants it all. But luckily, many small businesses can clearly separate wants from needs. If the mail servers we mentioned don’t satisfy your platform, security and feature requirements, pick another mailserver that fits.

For starters, we listed a variety of contenders in a couple of articles in December 2005: The borg Are Coming… for Microsoft? and Wolves Circle As Exchange Nears Death. And if Exchange ends out fitting the bill, so be it.

You’ll still need to decide whether your security needs are better protected by the SBS all-in-one solution or a standalone Windows server. But we’d add that, if Vlad (or equal expert) will be administering your network, you won’t go wrong following his advice. He knows where most of the SBS, Windows and Linux bodies are buried, and will keep any system under his wings tweaked appropriately.

As long as you’ve considered all of your options carefully, you’ll know who to blame for any negative outcomes: You.