Hi everyone,

I have Debian Squeeze which is shipped with Apache 2.2.16, the latest version of the package. For PCI compliance I need to upgrade to the latest 2.2.26. But this version does not exist as a binary package so I need to compile and install it manually.

The problem is I have no experience in compiling (not so much experience in Linux to be honest), and I wonder how I can compile and install the 2.2.26 version at the same location as the existing version, and keeping all the config files.

How can I do this? I don't know where exactly Apache2 is installed, and how to configure the config file to point to that location.

Thanks in advance
Renaud

You should be able to just do an apt-get update apache2 and use your package manager to update to the most recent version.

Just make backups of your apache config files in /etc/ usually /etc/httpd or /etc/apache2/

Hi,

I don't know what PCI is, so I wonder is this a security issue or a feature issue.

If it is a security issue you need to understand Debian backports all security fixes in its stable releases. Therefore, the Apache 2.2.16 you have in Debian is as secure (and possibly more secure since new versions often introduce new bugs) than a stock 2.2.26.

Evo2.

Thanks for your messages guys.

PCI compliance is a security thing required by banks for credit card payments. They scan your server and generate a report with security problems.

They want me to upgrade to 2.2.26 because there are some security issues/bugs in the previous Apache versions.

Kustom42: I cannot do this as the latest official version is 2.2.16
http://packages.debian.org/squeeze/apache2

So my only solution is to install manually Apache2 with compiling.

Renaud

Hi,
Since Debian 6 is still supported, the fixes to those issues/bugs will have already back ported to your Apache version. Check the changelog.Debian.gz for confirmation. Its very scary to think that a standards body for internet banking is not aware of such basic security practices. Please do a little research to confirm what I have told you is legit and then try to explain it to The PCI people.

On a related topic Debian 6 will EOL soon, so you should make preparations to upgrade to Debian 7.

HTH,

Evo2.

Hi Evo2,

What you say makes sense, but unfortunately it looks like the backports are still lagging behind.

For instance the latest version of Debian was modified on 04 Mar 2013 to fix some security issues:

http://ftp-master.metadata.debian.or...ze11_changelog

But my PCI scan complains (among others) about CVE-2013-186 security failure, which was reported on 06/10/2013.

So the latest version of the package cannot contain the required security fix...

Cheers
Renaud

PCI compliance is the stupidist thing I have ever had to deal with a bunch of ridiculous automated scan reports that come from a company who has no idea what the report even means. I had a customer who was not able to obtain PCI complaince due to a CVE that had 0 potential for any sort of exploit or security vulnerability.


Getting PCI compliant is a pain and you will more than likely have to switch to another OS distro that you can be complaint with. They are more lenient with Windows only because the community is not as strong as it is with Linux and people do not report bugs the minute they discover them as its not an open source product. So with Windows Server 08R2 all you really have to do is run windows update, make sure you have the latest version of Apache installed and turn on the Windows Firewall.


With Linux you have to spend time patching every single thing that a bug has been identified with. Just an FYI from my personal experience, and no matter what you say to the PCI scan company about a specific bug they will not change what their scan identifies.

1 members found this post helpful.

Kustom42 I can't agree more with what you said...

But for some reason this is a standard and I have to stick with it..

At the moment I am testing/configuring the latest version of Apache I compiled myself and going through all the config...

Hi,

it appears that my initial fears about PCI were true. Thanks for the insight Kustom42.

Cheers,

Evo2.