Apache upgrade

[rog]

Hi there! I just purchased a B3 to run a couple of websites off, but I'm running into a couple of problems that I'm not finding documentation on. The first one is baffling me - I'm trying to update Apache to the current version; since there have been so many security problems with Apache over the past couple of months, it seems only prudent. So first I checked what the running version was:

root@b3:/home/roger# apache2 -v
Server version: Apache/2.2.16 (Debian)
Server built: Aug 29 2010 15:16:06

That seems kind of old. So after finding out what the current version number is (2.2.21), I ran:

root@b3:/home/roger# apt-get upgrade apache2

Some code flashes by, it tells me it's going to install x amount, yes or no, I type yes, and off it goes. A while later, it says it's finished, and has been restarted. So again, I type apache2 -v, and it tells me the exact same thing it told me above. Tried rebooting the server, same thing. So then I try going to the B3 admin page, and from there to the software update section. I hit update system. Off it goes on it's merry way for a few minutes. After finishing, I check yet again...and again, Apache has not been upgraded.

Can anybody tell me what I'm doing wrong here?

Thank you.

[johannes]

The update system uses pinning to ensure apache is upgraded from our repos, to ensure not breaking any other parts of the sytem by installing untested new versions. We regularly release updates of all upstream packages but want to test first, this explains the slight delay.

We are releasing version 2.4 soon, which includes an apache update aswell. If you manually wish to update apache manually before this this is possible, but I'll have to ask Carl (our debian hero). Reply if this is of interest and we'll get back.

[rog]

Hi johannes - yes, I would like to know how to manually update apache, if at all possible. The vulnerability that has been exposed in it recently is a rather serious security issue, and that's one thing I really want to keep updated. If you and Carl could help me out with that, that would be lovely, thank you.

[beweb]

I want to support rog on this one.
I think it is necessary to have a Howto\Wiki available for upgrading the apache on your own request.

[johannes]

HI again. Ok, checked this up and it was more complex than I had hoped. You can upgrade it (by pointing sources.list upstream and doing the update) but this will break stuff since you need a matching libapache2-mod-php5, which is built by us (since we rely on a fix not yet released upstream).

We could probably do a howto on how to build it, but now it's getting complicated. I'll discuss this internally and see if this is possible. Until then, we moved the apache upgrade to our next release (2.3.1) which is quite soon (weeks). I hope this is good enough for now.

[rog]

Ok, it sounds like you guys have a pretty highly customized version of debian running on the B3...is it possible for me to install a different linux os, a more traditional one that would allow me to perform necessary security updates without breaking anything? I understand that I would probably be voiding my warranty and giving up most of the customer service you offer, and honestly, I'm probably not going to do it. But I just want to know what my options are, just in case.

[RandomUsername]

There is a thread somewhere on how to install plain debian. It's not easy. You wouldn't be voiding your warranty though, just don't expect official support.

[johannes]

Here is the guide:
http://wiki.excito.org/wiki/index.php/R ... stallation

It shouldn't be difficult if you have some command-line experience, and you will not void warranty. However, we might ask you to re-install the normal installation if you need support on software stuff.

[rog]

That's exactly what I needed. Thank you.

I'll probably try the new software version when it comes out, anyways, but what the heck, I have some free time.

[carl]

Ok, it sounds like you guys have a pretty highly customized version of debian running on the B3...is it possible for me to install a different linux os, a more traditional one that would allow me to perform necessary security updates without breaking anything? I understand that I would probably be voiding my warranty and giving up most of the customer service you offer, and honestly, I'm probably not going to do it. But I just want to know what my options are, just in case.

Regarding php and our modification, it is related to http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505743 which sadly hasn't been fixed yet in debian. (The modification is only to separate the SAPI configuration, but sadly the whole package needs to be rebuilt)