End of CentOS Linux. Where to migrate? Hello everyone! As you probably know, CentOS Linux, the main Enterprise-level Linux server distribution, will soon disappear. It wasn’t hard to predict when RedHat acquired CentOS in 2014, and now it is actually happening. End of life of CentOS Linux 8 was 31.12.2021. There won’t be CentOS Linux as downstream for RedHat anymore. Only CentOS Stream, that will be upstream for RedHat, more or less a testing distro like Fedora.

Of course, it is a matter of debate whether security guys can actually decide which Linux distributions a company will use and set that as a requirement. But in any case, the security guys will definitely take part in the decision. I made a poll in my Telegram channel. 113 people voted. So, let’s take a look at the results and discuss which of the Linux distributions we can recommend to IT teams.

First of all, CentOS. Of course you need to deal with CentOS 8 installations as soon as possible because it won’t receive any security updates. But the EOL of CentOS 7 will only happen in July 2024. So, these CentOS 7 hosts can be ignored for a while. 15% will act likes this.

16% will switch to commercial RedHat Enterprise Linux. This is probably what the guys at RedHat want as a result of these changes. On the one hand, this will give a better experience and support, but it is expensive and comes with other risks. For example license policy change, export restrictions, service restrictions.

Unfortunately I forgot to add a CentOS Stream option. But it will probably be somewhere in the 5% Other.

For those who need a distro similar to CentOS Linux, but from a different vendor, a distribution with history – Oracle Linux (9%) – is a natural option.

Oracle Linux is a Linux distribution packaged and freely distributed by Oracle, available partially under the GNU General Public License since late 2006. It is compiled from Red Hat Enterprise Linux (RHEL) source code, replacing Red Hat branding with Oracle’s. It is also used by Oracle Cloud and Oracle Engineered Systems such as Oracle Exadata and others.

Other options are the two relatively new distributions Rocky Linux (2%) and AlmaLinux (3%).

Rocky Linux is a Linux distribution that is intended to be a downstream, complete binary-compatible release using the Red Hat Enterprise Linux (RHEL) operating system source code. The project’s aim is to provide a community-supported, production-grade enterprise operating system. The first release candidate version of Rocky Linux was released on April 30, 2021, and its first general availability version was released on June 21, 2021.

AlmaLinux is a free and open source Linux distribution, created originally by CloudLinux to provide a community-supported, production-grade enterprise operating system that is binary-compatible with Red Hat Enterprise Linux (RHEL). The first stable release of AlmaLinux was published on March 30, 2021.

With new distributions, there is a danger that for some reason they will stop developing and support will be inadequate. But over time, this will change.

The majority of voters are radically switching to deb-based distributions: Ubuntu (37%) and Debian (17%).

I also voted for Ubuntu. Why do I think Ubuntu is a good option to switch? First, it is one of the most widely used Linux distribution. I wish I could back this up with some good recent statistics, but I couldn’t google it. All the studies I saw were inadequate. Anyway, here is the “Percentages of websites using various subcategories of Linux“, W3Techs.com. In any case, it is extremely popular. Accordingly, if any critical problems are found there, these problems are fixed there very quickly, because they affect so many people.

In terms of information security, I like that they provide their own OVAL (Open Vulnerability and Assessment Language) content. So, it is clearly seen how to detect vulnerabilities correctly in this operating system. Therefore, I would recommend switching from CentOS linux to Ubuntu. More precisely, the LTS version of Ubuntu Server. I would be glad to know your opinion on this subject in the comments.

Of course there are many options that I didn’t add to the voting. For example, there must be SUSE. 😔 I’m sorry about that. Let’s assume that this is also in 5% Other.

Alexander Leonov

Hi! My name is Alexander and I am a Vulnerability Management specialist. You can read more about me here. Currently, the best way to follow me is my Telegram channel @avleonovcom. I update it more often than this site. If you haven’t used Telegram yet, give it a try. It’s great. You can discuss my posts or ask questions at @avleonovchat.

А всех русскоязычных я приглашаю в ещё один телеграмм канал @avleonovrus, первым делом теперь пишу туда.