[CentOS] Apache RPM's

[Johnny Hughes]

Ross S. W. Walker wrote:
> Johnny Hughes wrote:
>> Bob Boilard wrote:
>>> Hello all,
>>>  
>>> I love CentOS, but I am seriously regretting selecting 
>> Centos 4.4 for my
>>> production hosting servers. The current situation with 
>> CentOS 4.4 and being
>>> stuck at Apache 2.0.52 is a huge problem because of the new 
>> requirements for
>>> the Credit Card industry PCI scan. Apache 2.0.52 does not pass PCI
>>> compliance scans. which means no ecommerce on any of these 
>> servers - MAJOR
>>> ISSUE. So my question to the community is: when are new 
>> Apache RPM's going
>>> to be released or at minimum a backported version that 
>> plugs these security
>>> holes so we can pass PCI scans. Apache 2.0.52 has some 
>> major issues that
>>> need to be dealt with?
>>>
>> I am almost positive that this issue is one of the scan 
>> software using 
>> version numbers and not understanding that RHEL backports fixes.
> 
> It is a big fear of mine that this may become more and more
> of an issue when government agencies start setting stricter
> and stricter software compliance guidelines.
> 
> The agencies don't know what security backports vendor XYZ
> has implemented and frankly they don't care. All they have
> is a list of minimum version numbers that software must be
> at in order for it to be deemed "compliant".
> 
> I think we will start seeing this in the PCI and HIPA
> compliance regulations first, but I wouldn't be surprised
> if it leaks out into GLBA and other regulations over time.
> 
> I think it will be these compliance issues that may force
> upstream to change their strategy otherwise I can see this
> being a roadblock to RHEL/CentOS adoption in these
> industries in the future.
> 
> -Ross

OR force the scanner people to support backports.

There are already Nessus templates that support CentOS/RHEL scanning for 
PCI compliance.

Being that RHEL is 85% (ish) of the paid enterprise server market and 
EAL certified and running on many government sites already, I would 
imagine that the scanners will be the things to change.

I could be wrong ... that HAS happened before :-) ... but that is my take.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 252 bytes
Desc: OpenPGP digital signature
URL: <http://lists.centos.org/pipermail/centos/attachments/20080213/dff4ee25/attachment.sig>