is it ok to use old apache versions

[webhost]

is it ok to use old apache versions (like 1.3.6, 1.3.9, 1.3.12) do they have any security holes?

[HarborNetworks]

I would stay as current as possible due to security holes. You might be limited by your modules as to what version you have to run. You should always try to stay as current as possible with all your packages. For the most part many of the updates are because of security issues. Some are due to new features, but every update fixes some sort of technical or security issues that were in the previous version.

[hololi]

I agree with HarborNetworks in keeping as uptodate as possible

Why would you want to use an old apache anyway ?
The latest and greatest is always very easy to download /compile

I suspect you have a version running in "production" and don't want to mess with it
if this is the case I'd

save your current httpd.conf somewhare safe (hell save the whole thing)
download,compile and install the latest apache with a major number similar to your current versions
i.e. the latest 1.3.x rather than 2.0.x for ease of migration

pop in your saved httpd.conf and see what happens

If you want I have a quicktip on how to build apache, openssl and tomcat from source and integrate them together
see http://www.smartframeworks.com/qt-apache-ssl.html

good luck
hololi

[matt2kjones]

If your worried about downtime do this:

compile the latest apache to either:

/usr/local/apache-2.0.47
OR
/usr/local/apache-1.3.28

depending on what you prefer

then copy the config to the new apache....
then start the new apache on port 90

set it up until your happy its working how you want it

then stop it, set it back to port 80

stop the old apache, start the new apache, and wolla, you have just upgraded apache with less than 10 secs downtime

[hololi]

is it ok to use old apache versions (like 1.3.6, 1.3.9, 1.3.12) do they have any security holes?

I agree with all comments above. You should stay as current as possible.

If you have an old version of apache in production then you should upgrade asap.

There are currently 2 streams of apache the 1.3.x and the 2.0.x If you have an old version I'd recommend getting the latest and greatest 1.3.x version

back up the whole thing (espeically httpd.conf and the contents of your websites /virtual hosts)

hell you should have a development box you can try it on first.

I have a few "quick tips" on how to build apache at
http://www.smartframeworks.com/qt-apache-ssl.html that might be of help

good luck
Hololi