store | blogs | forums | twitter | facebook | wiki | mailing lists | downloads | support portal
Atomic Secure Linux
It is currently Fri May 24, 2013 1:19 pm

» Feed - Atomicorp

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic Share/Bookmark  [ 6 posts ] 
Author Message
 Post subject: Apache 2.2.16
Unread postPosted: Mon Aug 30, 2010 3:29 pm 
Offline
Forum User
Forum User

Joined: Tue May 05, 2009 11:02 am
Posts: 7
I need to pass a PCI audit, and it is failing on my apache version, I have 2.2.3-43.el5.centos

Is there an atomic version of the latest, or is that not in the atomic repo?

This is a Cent 5.5 / Plesk 9.52 system, by the way.

The PCI audit wants to see 2.2.15

Thanks


Top
 Profile  
 
 Post subject: Re: Apache 2.2.16
Unread postPosted: Mon Aug 30, 2010 5:38 pm 
Offline
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin

Joined: Wed Dec 31, 1969 8:00 pm
Posts: 7429
Location: earth
That is a false positive, you can refer them to this: http://www.redhat.com/security/updates/ ... c_cid=3093

That being said, we're considering adding httpd to the repo.


Top
 Profile  
 
 Post subject: Re: Apache 2.2.16
Unread postPosted: Mon Aug 30, 2010 5:51 pm 
Offline
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
User avatar

Joined: Thu Feb 07, 2008 7:49 pm
Posts: 3247
Location: Chantilly, VA
Also, if you are running ASL it will not report the apache version to the scanner so you wont run into this problem with PCI-DSS scanners and will pass.

_________________
Michael Shinn
Atomicorp - Security For Everyone

Co-Author of Troubleshooting Linux Firewalls.


Top
 Profile  
 
 Post subject: Re: Apache 2.2.16
Unread postPosted: Mon Aug 30, 2010 9:28 pm 
Offline
Forum User
Forum User

Joined: Tue May 05, 2009 11:02 am
Posts: 7
mikeshinn wrote:
Also, if you are running ASL it will not report the apache version to the scanner so you wont run into this problem with PCI-DSS scanners and will pass.


I thought I had that set in the httpd.conf by using the ServerSignature Off.


Top
 Profile  
 
 Post subject: Re: Apache 2.2.16
Unread postPosted: Mon Aug 30, 2010 9:59 pm 
Offline
Forum User
Forum User

Joined: Tue May 05, 2009 11:02 am
Posts: 7
scott wrote:
That is a false positive, you can refer them to this: http://www.redhat.com/security/updates/ ... c_cid=3093


Thank you, I will try that route.


Top
 Profile  
 
 Post subject: Re: Apache 2.2.16
Unread postPosted: Tue Aug 31, 2010 3:56 pm 
Offline
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
User avatar

Joined: Thu Feb 07, 2008 7:49 pm
Posts: 3247
Location: Chantilly, VA
I believe ServerSignature Off. doesnt actually hide the version or if it does, it doesnt do it very well.

_________________
Michael Shinn
Atomicorp - Security For Everyone

Co-Author of Troubleshooting Linux Firewalls.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic Share/Bookmark  [ 6 posts ] 

» Feed - Atomicorp

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Bing [Bot] and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group