Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

From PCI scan results:

Synops is : The remote service encrypts traffic using a protocol with known weaknesses .

Description : The remote service accepts connections encrypted using SSL 2.0, which reportedly suffers from several cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients .

See also : http://www.schneier.com/paper-ssl.pdf

Solution: Consult the application's documentation to disable SSL 2.0 and use SSL 3.0 or TLS 1.0 instead.

Risk Factor: Medium / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)

I have tried to change

SSLProtocol all -SSLv2 to SSLProtocol -ALL +SSLv3 +TLSv1

And SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW to SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:!MEDIUM:!LOW:!SSLv2:!EXPORT

But using SSLdigger, it shows the same result. Is this the right way to do something like this?

share|improve this question

3 Answers 3

up vote 0 down vote accepted

For Apache these lines should be sufficient:

SSLProtocol -SSLv2 +SSLv3 +TLSv1
sSLCipherSuite ALL:+HIGH:+RSA:!MEDIUM:!LOW:!EXP:!ADH:!NULL

You can add MEDIUM if you want, MEDIUM is 128-bit in Apache, but most browsers support high, so it's usually unnecessary. Note that most other resources use the term "medium" for 56/65/96-bit encryption, so be careful to compare bit levels, not names.

The e-mail stuff we'd have to know what software you're running. 465 is SMTP over SSL. 993 is IMAP over SSL. 995 is POP3 over SSL.

share|improve this answer
    
That did it thanks.. –  user64991 Dec 29 '10 at 19:36

See https://www.pcisecuritystandards.org/documents/pci_dss_v2.pdf. Specifically for this, page 35. You're not actually required in any way to modify your SSL settings for PCI compliance if they're not insecure -- which is different than "weaker, but backwards compatible." That said, it seems you're trying to configure your SSL settings in one place, but you need to alter it for each daemon. Depending on your systems configuration, offloading your SSL to an endpoint may make management of this easier.

share|improve this answer

I ran into the same issue a few weeks ago. I found the solution in this article:

SSL cipher settings - For the good of all of us

The configs for various programs are at the end of the text, but the article is
a damn good read on this topic. So take a few minutes and read it completely.

Best regards, Phil.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.