-1

(I am not sure if this question fits in serverfault.com. If not, forgive me.)

I maintain my client's ecommerce website and the credit card processing company requires PCI compliance. For that, our site needs to be scanned. I had to whitelist the scanner IP by setting up the iptables on my Ubuntu 14.04 server. Still the scanner can't scan the site.

Here's the message from the scanning company's support:

Even though there is no scan blocking on the website there is still something preventing our scanner form getting through. It is your responsibility to figure out what is causing the scanner not to see your site.

I asked what kind of scanner it was and he answered:

The software we use is Rapid Scan.

I don't know what to do. Please help me.

2
  • 3
    Ask them what, exactly, technically, and in detail, "getting through" means. Aug 12, 2015 at 18:01
  • @MarkWagner Yes. I actually did but they didn't answer. I'll try again. Thanks.
    – Sam Kong
    Aug 12, 2015 at 18:54

1 Answer 1

3

Get a scan triggered at a time you've got a tcpdump running on the server, watching for all packets from the whitelisted address. If there are no packets, it isn't a server problem (could be you've got an upstream firewall issue, or the scan provider's given you the wrong IP to whitelist). If you do see packets, what they're doing will give you a good indication of where to go next. If you're only seeing SYNs come in, then your firewall isn't as opened up as it should be. If there's some traffic flowing, but it stops quickly, perhaps some security rules in the webserver (or an IDS) is detecting the scan as malicious behaviour and blocking it.

Not the answer you're looking for? Browse other questions tagged .