Title summarizes my question best.
I am trying to make my ubuntu 10.0.4 server PCI compliant, and to do so, the last bullet on the list is to make sure it isn't vulnerable to the BEAST attack. To do this, I can disable SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but according to the following link:
this will break compatibility with certain implementations of SSL, without really offering much of a security benefit since the BEAST attack is impractical and modern browsers don't allow arbitrary code to run.
The end goal is the following: be PCI compliant, but without an impractical solution (e.g. I'm not willing to disable TLS 1.0).
Edit: moved secondary question to a separate question: Where can I find the file to set SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS