4 ms·
Our web servers run Debian for the most part. The only real hassle has been with PCI-DSS compliance. For example, Debian Squeeze has Apache v. 2.2.16 (or did u
by redsymbol 15y ago
Our web servers run Debian for the most part. The only real hassle has been with PCI-DSS compliance. For example, Debian Squeeze has Apache v. 2.2.16 (or did until recently), which our compliance scanning vendor flagged as having several unacceptable security holes.
The solution that's worked well is to just selectively upgrade the handful of offending packages: either from testing, or some other source, or in rarer cases, compiling from source. Annoying and time-consuming, but soluble, and IMO worth the tradeoff given Debian's other good qualities right now.
- kev009 15y agoYour scanning vendor should know better and advise you properly. Just kidding, the "security" industry sucks. Debian and other long term enterprise distributions backport fixes for these unacceptable security holes. A better solution is to simply turn off the minor version string as that's the extent of their testing. I'd guess a good number of people intuitively do what you did. The problem is, instead of getting sucked in by a scheduled apt-get update, now you probably wont notice critical fixes until the next quarterly scan is due.
- jcurbo 15y agoYou could see if updated versions are in the Debian backports collection. You can pick and choose your updates via apt pinning.