{"id":923,"date":"2012-03-06T11:00:35","date_gmt":"2012-03-06T16:00:35","guid":{"rendered":"http:\/\/it.thelibrarie.com\/weblog\/?p=923"},"modified":"2012-03-06T11:03:18","modified_gmt":"2012-03-06T16:03:18","slug":"pci-audit-vs-ubuntu-server","status":"publish","type":"post","link":"https:\/\/it.thelibrarie.com\/weblog\/2012\/03\/pci-audit-vs-ubuntu-server\/","title":{"rendered":"PCI Audit vs Ubuntu Server"},"content":{"rendered":"

I was in the midst of my first ever PCI audit – the company I was doing work for wanted to start taking credit card orders over their website. I thought it would be easy – the website was a wrap-around of the credit card company’s authorization site, so no numbers ever touched the company-owned systems. Unfortunately the security firm required all external facing IP addresses to test. One of those IP addresses pointed to an Ubuntu 10.04.4LTS system that was running Owncloud software on apache (think DAV for multiple users via web interface).<\/p>\n

So the PCI audit returns with a giant FAIL. Apache is out of date!<\/p>\n

apache2 -v
\n2.2.14
\nThis version came out in October of 2009.<\/p>\n

So I edited the apt sources list to grab a newer file:
\nnano \/etc\/apt\/sources.list<\/code>
\nAnd added:<\/p>\n

deb http:\/\/us.archive.ubuntu.com\/ubuntu\/ oneiric main
\ndeb-src http:\/\/us.archive.ubuntu.com\/ubuntu\/ oneiric main<\/p><\/blockquote>\n

apt-get update<\/code>
\napt-get install apache2<\/code>
\napache2 -v<\/code>
\n2.2.20
\nThis version came out in August of 2010<\/p>\n

Run the PCI compliance test again – FAIL. Apparently they require 2.2.21 or higher. The only issues I could find with 2.2.20 deal with mods being enabled that they don’t use, or .htaccess permissions that they also don’t use. OK, so let’s go up another version.<\/p>\n

nano \/etc\/apt\/sources.list<\/code>
\nAdd:<\/p>\n

deb http:\/\/us.archive.ubuntu.com\/ubuntu\/ precise main
\ndeb-src http:\/\/us.archive.ubuntu.com\/ubuntu\/ precise main<\/p><\/blockquote>\n

apt-get update<\/code>
\napt-get install apache2<\/code>
\napache2 -v<\/code>
\n2.2.22
\nThis version came out in January of 2012<\/p>\n

I verified the site was still working. Make sure you comment out the sources.list precise and oneiric otherwise you’ll have lots of update issues down the road.<\/p>\n

Source generator:
\nhttp:\/\/repogen.simplylinux.ch\/generate.php<\/p>\n","protected":false},"excerpt":{"rendered":"

I was in the midst of my first ever PCI audit – the company I was doing work for wanted to start taking credit card orders over their website. I thought it would be easy – the website was a wrap-around of the credit card company’s authorization site, so no numbers ever touched the company-owned … Continue reading PCI Audit vs Ubuntu Server<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-923","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/posts\/923","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/comments?post=923"}],"version-history":[{"count":2,"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/posts\/923\/revisions"}],"predecessor-version":[{"id":925,"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/posts\/923\/revisions\/925"}],"wp:attachment":[{"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/media?parent=923"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/categories?post=923"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/tags?post=923"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}