The Payment Card Industry Data Security Standard (PCI DSS) is a worldwide security standard that was formed with the support of credit card companies to align their security standards.

learn more… | top users | synonyms

1
vote
0answers
25 views

How to enable TLS 1.1 **minimum** on vsftpd

I'm trying to secure my infrastructure to meet the PCI-DSS standard using securitymetrics.com. The standard mandates the use of TLS 1.1 minimum (with a CBC cipher). TLS 1.0 is not allowed. While ...
1
vote
0answers
13 views

PCI Scan failed with SSL certificate with wrong name

I've an IIS server which is hosted around 250 + sites. I am running a PCI scan against one website and its failing with these 2 errors: Common name of SSL certificate presented on this server is for ...
-3
votes
2answers
39 views

PCI DSS Site audit complian scan [closed]

We have been asked to turn off our anti-intrusion software and allow a specific IP address unrestricted access through our firewalls by a PCI DSS compliance scanning firm engaged by our merchant ...
0
votes
1answer
42 views

PCI Scan failing at TCP Source Port Pass Firewall testing

I'm trying to get PCI scan PASS for my website, Scan failing at this step. The host responded 4 times to 4 TCP SYN probes sent to destination port 20 using source port 80. However, it did not ...
0
votes
0answers
13 views

Is there a way around Apache HTTPS redirect filtering blocks?

I am currently using a mod_security HTTPS redirect in order to maintain PCI requirements. However, I have noticed that many commercial web filters (i.e. websense) are blocking the site due to a proxy ...
5
votes
1answer
118 views

Limit number of concurrent users switching to root account?

This is for Ubuntu 14.04 and Centos 7. I need to limit the number of users actively running as root. i.e. Logged in as root on the CLI. Basically, I want only one user at a time to be able to run ...
1
vote
0answers
72 views

How do I solve cve-2015-3183 without updating Apache

During the latest app scan in my project, CVE-2015-3183 has popped up. I have looked everywhere on the net for solution. Solution is simple: update your Apache. The problem is we cannot update our ...
1
vote
1answer
333 views

SSL config for web server compatible with PCI-DSS requirements about disabling CBC and TLSv1.0

I'm looking for web server (nginx) configuration that support current (Nov 2015) PCI-DSS requrements about SSL: No TLSv1.0 (only TLSv1.1 and TLSv1.2, and TLSv1.3 in the future). No weak ssl ciphers, ...
0
votes
0answers
343 views

(PCI-DSS, APF) Firewall UDP Packet Source Port 53 Ruleset Bypass?

I am handling vulnerabilities reported by a PCI-DSS scanner, and one of them is new to me: Title Firewall UDP Packet Source Port 53 Ruleset Bypass Synopsis: Firewall rulesets can be bypassed....
3
votes
2answers
856 views

PCI Compliance: install Apache 2.4.17 on Ubuntu 14.04.3?

I have a VPS running Ubuntu 14.04.3. The latest Ubuntu-supported version of Apache for this release is Apache 2.4.7. But the company for which I configured the server is seeking PCI compliance, and ...
1
vote
0answers
318 views

Audit trail for all actions taken with admin privileges

PCI DSS 10.2 says, "Implement automated audit trails for all system components to reconstruct the following events:" and 10.2.2 continues, "All actions taken by any individual with root or ...
1
vote
1answer
254 views

inactive option not working for pam_lastlog.so

I'm trying to set up my system to lock out inactive users after 10 days. I'm using CentOS 6.x, and looking at RHEL manual, this is what I found: To lock out an account after 10 days of inactivity, ...
-1
votes
1answer
209 views

SSL Certificate - Self-Signed Certificate

I'm trying to get PCI compliant and the PCI scanning company is showing below Fail scan report SL Certificate - Self-Signed Certificate SSL Certificate - Self-Signed Certificate port 25/tcp over ...
-1
votes
1answer
91 views

What's blocking the PCI compliance scanner from scanning my site? [closed]

(I am not sure if this question fits in serverfault.com. If not, forgive me.) I maintain my client's ecommerce website and the credit card processing company requires PCI compliance. For that, our ...
3
votes
0answers
79 views

Virtual terminal PCI compliance

The PCI DSS compliance rules say that if we use any computers to take card payments via a web based virtual terminal, then those PCs must be isolated from the rest of the IT network (otherwise the ...
4
votes
2answers
2k views

Disable TLS 1.0 in NGINX

I have a NGINX acting as a reverse proxy for our sites and is working very well. For the sites that need ssl I followed raymii.org to make sure to have as strong of a SSLLabs score as possible. One of ...
0
votes
1answer
62 views

XSS Vulnerability with PCI RapidComply

I have a website hosted on an Apache Tomcat 7 server that uses the Authorize.net gateway and merchant services to handle payment. I recently ran a required PCI Compliance test against my website, and ...
0
votes
0answers
50 views

Upgrade OpenSSL from 0.9.8 to 1.0.1 on RHEL 5.11 [duplicate]

PCI test is failing since SSLv2, v3, and TLSv1.0 are active (CVE-2014-3566, POODLE). I'm running on Red Hat 5.11 and Apache 1.3 (But fully plan to upgrade to Apache 2.2 to achieve TLSv1.1 and TLSv1.2) ...
1
vote
1answer
68 views

Apple Mail , Kerio connect and TLSv1 disabled

Due to PCI-DSS now requiring that TLSv1 is disabled to pass our network scan I have the following issue. Using Kerio Connect mail server (www.kerio.co.uk) Apple Mail (yosemite and all the way ...
0
votes
2answers
101 views

NGNIX, SSL Certificates and PC-DSSI 3.1

We are going to have to pass a PCI 3.1 audit for the web application we're currently developing. It's on Amazon EC2 running NGINX under Debian. We're in contact with Symantec for certificates and we'...
1
vote
1answer
2k views

Windows Server 2012 R2 IIS Weak Ciphers Reported After Lockdown

I am having issues getting a windows server 2012 R2 64-bit box locked down. I used a tool called IISCrypto to make the box FIPS 140 compliant. I have manually checked the registry entries and all the ...
37
votes
7answers
55k views

How do I disable TLS 1.0 without breaking RDP?

Our credit card processor recently notified us that as of June 30, 2016 we will need to disable TLS 1.0 to remain PCI compliant. I tried to be proactive by disabling TLS 1.0 on our Windows Server 2008 ...
3
votes
1answer
96 views

Password policies for Google Cloud Platform

Is there a way to set password policies for accounts accessing a project on Google Compute Platform? Specifically, I need to meet the PCI-DSS requirements, which include things that pam would ...
1
vote
0answers
117 views

Tracking user activity in openvz container?

I have been trying to figure out a way to track user activity in an openvz container for a long time now (auditd like in KVM's). This is a PCI-DSS requirement. I can't seem to find any good ...
0
votes
1answer
2k views

Can't access https web service from web server - Schannel fatal alert: 40

About a month ago our code to access a web service started failing, and gives an error relating to SSL connection: System.Net.WebException: The request was aborted: Could not create SSL/TLS secure ...
1
vote
1answer
275 views

Validating SSL/TLS renegotiation flaw

Our vulnerability scanner (Saint-based) is claiming that a large number of devices and servers are susceptible to the SSL/TLS renegotiation flaw (CVE-2009-3555). Most of these servers and devices are ...
3
votes
3answers
13k views

How Can I Enable MSS Group Policy Settings Windows Server 2012

In the past I have gone through a server hardening checklist on a Windows Server 2008 web server for PCI compliance. Basically there are a lot of Group Policy, Registry, and other settings that need ...
7
votes
1answer
941 views

PCI-DSS: Virtualization segmentation in ESXi environment

I have already asked this question over on Information Security but so far it has not garnered any comments. I am thinking perhaps it is more of a server infrastructure and configuration question, ...
36
votes
10answers
5k views

Run antivirus software on linux DNS servers. Does it make sense?

During a recent audit we were requested to install antivirus software on our DNS servers that are running linux (bind9). The servers were not compromised during the penetration testing but this was ...
0
votes
2answers
141 views

Mod-Pagespeed dropping headers

I'm using 1.6.29.7-3343 for css and images with Apache 2.2.15 (Unix) on RHEL 6. My pagespeed.conf config is here: https://gist.github.com/jhirbour/a66b0efe58c8d109b90e As part of our PCI our ...
-2
votes
1answer
128 views

PCI scan showing false positives on cloud-based server [closed]

I've run a third-party PCI scan recently on my website, and my main domain cleared 100%. The IP address, however, came up with some strange errors. It was claiming we were vulnerable to XSS attacks ...
3
votes
1answer
318 views

Cisco CVE-2014-0224 Vulnerability

We have a Cisco RV-042 Small Business router and our PCI scans flagged it as being vulnerable to CVE-2014-0224 (CCS Injection/Man-in-the-Middle). It appears to be another OpenSSL vulnerability. We ...
-1
votes
2answers
211 views

How to mask(alter) the apache version info

I am running a Apache Server version 2.22, which is upto date, but the PCI compliance report shows an error message, saying the apache version is obsolete and must upgrade it to latest version. I am ...
-1
votes
1answer
565 views

Hidden Directory Detected

My company web application had a penetration testing done and there's a risk found is regarding the hidden directory: http://example.com/aux/ http://example.com/cgi-bin/ http://example.com/com1/ ...
0
votes
1answer
159 views

Computers in-scope for PCI DSS [closed]

I am trying to determine what servers & workstations, etc. that are in-scope for PCI compliance. PCI DSS SAQ-D states that any devices that "store, process or transmit cardholder data" are in ...
0
votes
3answers
478 views

Track any file changes using auditd

I try configure PCI REQ 10.5.5 "Use file integrity monitoring or change detection software on logs" Use auditd for this, rule "auditctl -w /tmp/testfile -p war" works perfectly. But if I try to use ...
0
votes
1answer
198 views

PCI compliance and SSL certificates on a CentOS VPS [closed]

looking for a bit of advice please. We've been battling with a PCI compliancy project for the last couple of days and we've managed to eliminate most of security warnings. What we're left with now is ...
7
votes
1answer
238 views

PSTools psexec and PCI

I am just wondering if anyone knows of any reason why using psexec would cause the failure of a PCI DSS audit. I have never been able to find information, though have always been told that it can't ...
3
votes
1answer
2k views

Upgrading OpenSSH on web server (Ubuntu) for PCI Compliance

I've been trying to upgrade OpenSSH for PCI compliance on our company's web server. I cannot for the life of me figure out how to do this though. I have attempted the following commands via SSH (...
1
vote
0answers
397 views

Separating Secure Network and DMZ (nonsecure) in a PCI Compliant Infrastructure

We are setting up a PCI Compliant infrastructure where most of our applications are running in a DMZ (demilitarised zone) that contain no sensitive information. The part that contains sensitive ...
1
vote
2answers
171 views

Quarterly external vulnerability scans, IPs to include

I have questions regarding the PCI DSS requirements for quarterly external vulnerability scans by an ASV, specifically what public IPs I need to include in these scans. The organization is a retail ...
3
votes
1answer
673 views

Ubuntu PCI-DSS Compliance Issue

I'm trying to get PCI compliant and the PCI scanning company is flagging our Ubuntu 12.04 PHP 5.3.10-1ubuntu3.9 for CVE-2013-1635. According to http://people.canonical.com/~ubuntu-security/cve/2013/...
0
votes
1answer
495 views

PHP and PCI Compliance

I have a web server that needs to pass a PCI compiance scan by ControlScan. Everything is good except for a scan they did of the PHP version. I believe I have the latest version that CentOS provides....
1
vote
2answers
701 views

trustwave pci scan: dns amplification denial of service, Bind 9.8.1-P1, doesn't seem like it

In our last TW PCI scan, one of our flags was "DNS Amplification Denial of Service". Right now, the DNS server is running Bind 9.8.1-P1. It seems like the CVEs are for a much older version: CVE-2006-...
2
votes
2answers
6k views

How do I get a friendly error page to replace the asp.net error page for url “WEB-INF./web.xml”?

This url is part of a pci compliance scan and it is flagging the very sparse asp.net error page returned, which on the live site is a 500 status code and the text Server Error in '/' Application. ...
0
votes
2answers
212 views

Ubuntu CVE-2013-1635 PCI DSS

I'm trying to get PCI compliant and the PCI scanning company is flagging our Ubuntu 12.04.3 (PHP 5.3.10-1ubuntu3.8) for CVE-2013-1635 [1] which says "we do not support the use of open_basedir". What ...
0
votes
1answer
302 views

Remote MySQL PCI Compliance

Using Stripe to process credit card payments and storing client payments and information in a mysql database. Only storing the id of the transaction, and the client ID. Stripe takes on a majoring of ...
0
votes
1answer
1k views

Bastion host for PCI compliance

A client in the retail industry has a network with point-of-sale (POS) terminals that connect to a POS Server. Additionally, most of the Windows workstations in non-sales areas also connect to the ...
0
votes
1answer
696 views

Are using ssh keys PCI compliant?

From PCI-DSS point of view, are using SSH keys for passwordless authentication secure enough? TIA, Vitaly
0
votes
2answers
2k views

How to determine SSL Cipher strength

I have updated my ssl.conf file on my Apache2 configuration to use the following SSLCipherSuite SSLProtocol all -SSLv2 SSLCipherSuite HIGH:MEDIUM:!ADH However the PCI scan seems to detect that WEAK ...