If this is just a personal server, you’re OK running Ubuntu. However, I’d be very cautious about deploying Ubuntu on any outward-facing box. It’s “Debian-based” only in the sense that it uses APT and the config files are done the “Debian way”; beyond that, the Ubuntu server platform uses many Ubuntu-created tools, some of which have not been battle-tested the way other more well-known distros’ environments and tools have.
RedHat, CentOS, SUSE, EnGarde Linux, any of the BSDs and even Debian itself (the whole recent SSL thing aside) are better choices for public servers than Ubuntu. These distros have millions of uptime-hours under their belts and have been subjected to serious scrutiny and hammering, formal and otherwise. Last I checked Ubuntu tends to place newer packages in its repos than other server distros, which is a bad thing because servers should NEVER have bleeding-edge, cutting-edge or even sort of dull but still pretty new-edge software available easily. And unless the Ubuntu team has changed things around since the last time I used it, all ports are wide open in iptables by default. Proper server security dictates that you start locked down and loosen up, not the other way around.
As for sudo being a better way than su…
Absolutely not. It is easier, but that doesn’t make it better. I run two *nix-based servers at home. One provides DHCP as well as local and public DNS; the other is a web server and SSH gateway to the rest of my network. I absolutely cannot have either of these machines compromised, ever.
Both are tightly firewalled using my router and finely-tuned iptables restrictions. On both of them I’ve moved common commands that can be used for reconnaissance (ps, who, ping, dig, ifconfig and about a dozen others) from /usr/bin into /usr/sbin (root only). And both use su only for root access. Why?
1. One more layer of security. Even if you figure out my ridiculously complex user password, you STILL have to figure out my even more complex root password before you can even learn anything about my boxes or network, much less change anything. And then if you want to hAx0r any of my other boxes, you have to go through that yet again with totally different passwords. I’ve got root login disabled over SSH, so nobody can get root on my boxes without first logging in as someone else.
2. Many people don’t realize this, but “sudo -i” is for all intents and purposes exactly the same as “su -” if you have full privs in /etc/sudoers. Namely, it drops you into a root shell with root’s environment (as opposed to sudo -s, which is a root-ish shell using your own environment). So on a sudo box, if you know my user password you can get unlimited-duration root access.
sudo’s only real security comes from properly configuring /etc/sudoers, but if you’re the lone admin of the box then you’re going to give yourself full rights to admin it unless you’re horribly sadistic and create separate user accounts for different admin functions (web, networking, logs, etc.).
But again, if this is only a personal or a non-critical server, by all means go with Ubuntu.