Why use CentOS when RHEL developer subs are free?
For our environment where we have a small deployment of only 2-4 machines,
CentOS is much easier to manage off-line on an air-gaped network.
Mirroring the CentOS repos is pretty easy to do with reposync and monthly
drops to a web server on the red network. The CentOS workstations can then
just point to the yum repos on said webserver and everything works like
it's supposed to. Trying to do this with RHEL-proper is frustrating at
best. A satellite server is way overkill for a deployment like this and
setting up the clients for a "normal" yum repo requires removing and
uninstalling all of the subscription / rhn packages. There's also the
simplicity of only have 2 system repos to worry about to get everything
available in CentOS (Base + Updates) vs dealing with the dozens of channels
needed in a RHEL subscription to get the same set of available packages. I
certainly get the value in all of the various options for managing large
enterprise deployments but CentOS is just much simpler to deal with for us
in a small deployment and software-developer-centric environment. We end
up using both RHEL and CentOS for different use cases but need to apply the
same security framework and settings to both.
With regards to allowed security configurations, as a contractor we've
never had issues with DSS and CentOS being allowed so long as we apply all
the appropriate RHEL rules and can appropriately justify where we diverge.
The only ones I've run into that end up not applicable across the two have
been FIPS related, which we have to disable anyways to accommodate third
party unsigned kernel modules for the Nvidia driver. The STIGs after all
are just a guideline and place to start from so you can adapt it to your
own environment with appropriate tailoring and justification, not a fixed
"it has to be this way". Most of the government entities we work with (DoD
and DoE) use RHEL for their infrastructure servers and end-user
workstations but CentOS for their projects and developer environments.
Many of the DoE labs we work with even use CentOS on their large scale HPC
deployments (LANL, Sandia, LLNL, etc.) while others use RHEL proper.
- Chuck