-1

I am running a Apache Server version 2.22, which is upto date, but the PCI compliance report shows an error message, saying the apache version is obsolete and must upgrade it to latest version.

I am on Ubuntu 12.04.5 LTS

my apache version:

Server version: Apache/2.2.22 (Ubuntu)
Server built:   Jul 22 2014 14:35:25

Is there any method to alter just the version of apache and make it 2.4?

any help is appreciated. Thank you :)

2

According to "http://www.tecmint.com/apache-security-tips/", you should be able to hide this information by adding the following in you httpd.conf and then rebooting Apache (apachectl restart):

ServerSignature Off
ServerTokens Prod
0

Your version is out of date and has many vulnerabilities. Why not upgrade to the latest and most secure version of apache rather than pretend there isn't a problem?

Change your ServerTokens in httpd.conf. For security purposes it's best not to give away any information that will give anyone a clue.

# vi httpd.conf
ServerTokens Prod
  • if I upgrade the apache, there are lots of sites I will need to change their configuration files. you know there is some directives changed as well with the new version. :) httpd.apache.org/docs/2.4/upgrading.html – shrish Sep 29 '14 at 8:57
  • @shrish so you'd rather administer a vulnerable webserver than do the job of the system administrator? – Dr.Avalanche Sep 29 '14 at 9:09
  • 2
    @Dr.Avalanche: enterprise releases, like Ubuntu LTS provide long term security and function stability by patching the original version they shipped, rather than upgrading to the next version. Red Hat does the same and explains that quite well here – HBruijn Sep 29 '14 at 9:11
  • While it may be a suboptimal version (and is not the one I run), he may have mitigating controls that he has (wisely) not told about, or may not be able to upgrade at this time because of externalities that you are not privy to. He asked about reducing the webserver daemon's signature, not how to secure it overall. When he is able to upgrade to a more current version, I hope he is taking the opportunity. – DTK Sep 29 '14 at 9:13
  • 1
    @shrish if your ogranisation scan like this and flag like this then you should raise the issue with them, and not hide it or pretend to run another version. – Dr.Avalanche Sep 29 '14 at 9:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.