Apache 2.2.16

[daffoml]

I need to pass a PCI audit, and it is failing on my apache version, I have 2.2.3-43.el5.centos

Is there an atomic version of the latest, or is that not in the atomic repo?

This is a Cent 5.5 / Plesk 9.52 system, by the way.

The PCI audit wants to see 2.2.15

Thanks

[scott]

That is a false positive, you can refer them to this: http://www.redhat.com/security/updates/ ... c_cid=3093

That being said, we're considering adding httpd to the repo.

[mikeshinn]

Also, if you are running ASL it will not report the apache version to the scanner so you wont run into this problem with PCI-DSS scanners and will pass.

[daffoml]

Also, if you are running ASL it will not report the apache version to the scanner so you wont run into this problem with PCI-DSS scanners and will pass.

I thought I had that set in the httpd.conf by using the ServerSignature Off.

[daffoml]

That is a false positive, you can refer them to this: http://www.redhat.com/security/updates/ ... c_cid=3093

Thank you, I will try that route.

[mikeshinn]

I believe ServerSignature Off. doesnt actually hide the version or if it does, it doesnt do it very well.