On Mon, Nov 03, 2003 at 12:48:56PM -0600, Al Gidden wrote: > The issue with the Apache version (even if it was patched to 2.0.48) > is that security programs check httpd and think it is 2.0.40. Therefore > they complain. (Websphere and JRun complain at install time because they > will not install unless you have 2.0.45 or later installed. So you > cannot deploy Websphere or JRun on RH9 until you solve the Apache problem. > Tomcat and other app servers have similar problems with the Apache > connector in 2.0.40). Frankly, both of those have bugs then. It's not Websphere's nor JRun's job to check to see if your Apache is patched. I had the pleasure or beating up a security "expert" who audited our systems and claimed we were vulnerable based on the version numbers returned. Could it be that Websphere or JRun required *features* in 2.0.45, rather than bug fixes? If the check is purely for security checking, then beat up your vendors and tell them to mind their own business (which is installing their products, not do a security audit on your system). > I agree with your knee-jerk reaction. The problem is that three Linux > admins have been on the problem for a week and cannot make any headroom. > Note that we can all compile Apache on any other Linux/UNIX and it works > fine. (and each have done so many times in the last years) > > We even tried to patch 2.0.40 at one time but we only managed to break it. > > My guess is that someone at RedHat tried to patch or install a later > version then 2.0.40 on RH9. Of course they tried. I'm running 2.0.46-25 on Red Hat Professional Workstation. You could try taking the source rpm for RHEL 3's httpd and rebuild that on RHL 9 and see if it works. -- Ed Wilts, Mounds View, MN, USA mailto:ewilts@xxxxxxxxxx Member #1, Red Hat Community Ambassador Program -- redhat-list mailing list unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe https://www.redhat.com/mailman/listinfo/redhat-list
