Questions tagged [pci-dss]
The Payment Card Industry Data Security Standard (PCI DSS) is a worldwide security standard that was formed with the support of credit card companies to align their security standards.
155
questions
1
vote
0
answers
31
views
Which directories get affected by "Linux PCI-DSS patch updates" and "Kernel update"
To achieve the PCI-DSS compliance, Company should apply all OS patching in monthly bases.
However, these patches affect the File Integrity monitoring, for example
/etc/bin /etc/include and much more ...
- 11
1
vote
1
answer
3k
views
Upgrade to openssh 8.3 (server) on debian 10 buster
Have a fairly vanilla Debian Buster (10) latest stable.
PCI Scan (sysnet/qualsys/worldpay) shows a PCI Compliance = NO vulnerability identified as CVE-2019-16905 https://security-tracker.debian.org/...
- 135
1
vote
1
answer
104
views
SOC2 Compliance and Hardware
Topic is SOC2 compliance relating to server hardware.
Simply put, we have a mixed bag of servers that, while perfectly suited to their job, are End of Life and End of Support with the manufacturer.
As ...
- 11
2
votes
2
answers
5k
views
IIS 10 how do I remove internal IP address from response headers
IIS 10 on Windows Server 2016. All current patches are installed. A recent PCI scan claims that the internal IP address of the server is being leaked in HTTP headers. Unfortunately, this scanning ...
- 338
0
votes
0
answers
46
views
PCI scanning and old certificates IIS 10 - Server 2019
Although this has never been a problem before, our PCI scanning provider is now throwing the toys out if it finds some old certificates, the fact the correct current one is showing when the user comes ...
- 353
0
votes
0
answers
167
views
OpenSSH Ubuntu Upgrade
We are currently using an EC2 (AWS) instance with Ubuntu 18.04.3 LTS, we are trying to perform a PCI compliant procedure and we had an error with OpenSSH being in an old version, so we have decided to ...
- 21
0
votes
0
answers
464
views
How to ensure client authentication work with 389 server with anonymous bind disabled?
While working on Internal PT for PCI DSS compliance, it flags that LDAP (389 server, FreeIPA) the anonymous bind is allowing listing list of user accounts.
Many searches are leading to setting up
...
- 1
0
votes
0
answers
326
views
PCI Compliance - SSL certificate doesn't match hostname (port 25)
I'm working on an Ubuntu server hosting multiple websites for one company. Trying to get one of the domains to be PCI compliant, but it's failing on port 25 (SMTP) because the SSL certificate hostname ...
- 137
3
votes
1
answer
207
views
is AWS Glue PCI DSS compliant?
I'm new to the PCI world, but need to research ETL (extract-transform-load) solutions for my team to move data from one place to another. I looked in amazon's list of PCI DSS compliant resources, and ...
- 43
2
votes
4
answers
4k
views
TLSv1 Not Turning Off in Apache
What is the best way to see where my SSLProtocols might be overridden on a CentOS 7 server? Apache 2.4.6 (realizing this is quite old as well so i'll have to update this off hours and see if it fixes ...
0
votes
1
answer
293
views
PCI Scanning Setup for Sonicwall & Windows Server 2012
I am trying to get our network to pass a PCI-compliance scan. Our hardware setup is: WAN -> AT&T modem (in passthrough) -> Sonicwall -> Win Server 2012r2 acting as domain controller / HDCP.
...
- 13
3
votes
1
answer
818
views
Why is TLS1.0 still seemingly supported on a "minimum TLS1.2" web app service on azure?
We have an app service on Azure, and as Microsoft made available recently (april 30 2018), we now have an option to require TLS 1.1 or 1.2 :
We run hackerguardian scans for PCI compliance, yet, they ...
- 143
0
votes
1
answer
1k
views
Forward Windows 2012 event logs from workgroup host to domain host
Is this possible? I've gone through the following but no events are forwarded.
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc748890(v=ws.11)
I ...
- 191
0
votes
1
answer
2k
views
Disable SHA1 now Firefox won't work
I've been tasked to get our site into PCI compliance by disabling SHA1 on the server. I am accomplishing this by using IIS Crypto 2.0. We decided to also go with just TLS 1.2. the specific problem I ...
- 121
0
votes
1
answer
535
views
Debian Stretch - PCI Compliance issue with OpenSSH version
One of the servers I look after is failing a PCI Compliance ASV scan.
The warning being picked up is:
The SSH server running on the remote host is affected by an information disclosure vulnerability....
- 153
2
votes
1
answer
585
views
Overwritten auditd rules in PCI DSS environement
I'm setting up a PCI DSS environment and I'm facing the next problem. When installing de OS (CentOS 7.3 Minimal) I've choosen the profile "PCI DSS".
When I was checkin the rules applied on /etc/audit/...
- 322
3
votes
2
answers
3k
views
Turn off TLS1.0 on Apache for PCI compliance
Pci DSS compliance stated that by June 2016 TLSv1.0 must be disabled. My cursory search taught me that a -TLSv1 in the SSLProtocals portion of the apache config would care for it (right next to the -...
- 668
56
votes
8
answers
175k
views
How can I disable TLS 1.0 and 1.1 in apache?
Does anyone know why i can't disable tls 1.0 and tls1.1 by updating the config to this.
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
After doing this, i reload apache I do an ssl scan using ...
- 673
0
votes
2
answers
413
views
Allowing remote access to a security camera DVR, while not leaving ports open to the public
I have a friend who runs a small business and needs to maintain PCI compliance. He also wants to allow remote access to his security camera DVR which is on the network, but doing so would break his ...
2
votes
1
answer
2k
views
How can I disable SSLv3/TLSv1/TLSv1.1 on port 3389 only
I am trying to remediate SSL/TLS vulnerabilities discovered by our vulnerability scanner. All the methods I have seen so far involve SCHANNEL changes in the registry. The SCHANNEL registry changes are ...
- 21
5
votes
3
answers
981
views
CentOS, OpenSSH, PCI, CVE-2016-10009
TrustWave has become a little better in accommodating CentOS in their scans - I can now at least select "I have backported software" when I file a dispute. But they are still providing excellent job ...
- 381
3
votes
1
answer
366
views
PCI DSS Requirement to prevent credit card data in logs, in conflict with having a search box anywhere?
We're currently setting up our existing web service to be PCI-DSS compliant and we're a little stumped on one of the compliance requirements.
In short, we need to ensure a credit card number is never ...
- 31
5
votes
0
answers
1k
views
Auditd in a PCI-DSS-compliant Linux cluster
I'm familiar with some of the more common ways of configuring a Linux server to be compliant with PCI-DSS 3.2, at least to the requirements of SAQ A. A common concern is requirement 8.5 which ...
- 151
-2
votes
1
answer
66
views
Apache Server Compatibility with PCI
I do not know if this is a proper place to ask, so please help me with this one.
Question: I want to know whether Apache web server is compatible with PCI Compliant Payment environment.
- 101
4
votes
2
answers
13k
views
How do I disable TLS 1.0 without breaking my IIS/ASP.NET websites?
We are running Windows Server 2008 R2. TLS 1.0 has been non-PCI compliant for some time now, and disabling it via the windows registry is easy. In the past, though, disabling TLS 1.0 has caused 2 ...
- 141
1
vote
1
answer
1k
views
Ossim setup in AWS
I have setup OSSIM in my virtual box and its working fine.
I tried to setup OSSIM in AWS cloud, but Alienvault stopped AMI for new customers.
How you are doing this for PCI-DSS as we are SME prefer ...
4
votes
4
answers
12k
views
How to enable TLS 1.1 **minimum** on vsftpd
I'm trying to secure my infrastructure to meet the PCI-DSS standard using securitymetrics.com. The standard mandates the use of TLS 1.1 minimum (with a CBC cipher). TLS 1.0 is not allowed.
While ...
- 397
1
vote
0
answers
318
views
PCI Scan failed with SSL certificate with wrong name
I've an IIS server which is hosted around 250 + sites. I am running a PCI scan against one website and its failing with these 2 errors:
Common name of SSL certificate presented on this server is for ...
- 13
-2
votes
2
answers
82
views
PCI DSS Site audit complian scan [closed]
We have been asked to turn off our anti-intrusion software and allow a specific IP address unrestricted access through our firewalls by a PCI DSS compliance scanning firm engaged by our merchant ...
- 337
0
votes
1
answer
1k
views
PCI Scan failing at TCP Source Port Pass Firewall testing
I'm trying to get PCI scan PASS for my website, Scan failing at this step.
The host responded 4 times to 4 TCP SYN probes sent to destination port 20 using source port 80. However, it did not ...
- 117
2
votes
0
answers
329
views
Docker / LXC and PCI-DSS Compliance
We are in payment space and we have built out a lot of our processes in Docker for development environment purposes. Now, we are thinking about converting our production environment which is in Xen (...
- 141
5
votes
1
answer
2k
views
Limit number of concurrent users switching to root account?
This is for Ubuntu 14.04 and Centos 7.
I need to limit the number of users actively running as root. i.e. Logged in as root on the CLI.
Basically, I want only one user at a time to be able to run ...
- 2,578
1
vote
0
answers
290
views
How do I solve cve-2015-3183 without updating Apache
During the latest app scan in my project, CVE-2015-3183 has popped up. I have looked everywhere on the net for solution. Solution is simple: update your Apache.
The problem is we cannot update our ...
- 11
2
votes
1
answer
3k
views
SSL config for web server compatible with PCI-DSS requirements about disabling CBC and TLSv1.0
I'm looking for web server (nginx) configuration that support current (Nov 2015) PCI-DSS requrements about SSL:
No TLSv1.0 (only TLSv1.1 and TLSv1.2, and TLSv1.3 in the future).
No weak ssl ciphers, ...
- 156
1
vote
1
answer
4k
views
(PCI-DSS, APF) Firewall UDP Packet Source Port 53 Ruleset Bypass?
I am handling vulnerabilities reported by a PCI-DSS scanner, and one of them is new to me:
Title
Firewall UDP Packet Source Port 53 Ruleset Bypass
Synopsis:
Firewall rulesets can be bypassed.
...
- 638
3
votes
2
answers
2k
views
PCI Compliance: install Apache 2.4.17 on Ubuntu 14.04.3?
I have a VPS running Ubuntu 14.04.3.
The latest Ubuntu-supported version of Apache for this release is Apache 2.4.7.
But the company for which I configured the server is seeking PCI compliance, and ...
- 31
2
votes
1
answer
3k
views
Audit trail for all actions taken with admin privileges
PCI DSS 10.2 says, "Implement automated audit trails for all system components to reconstruct the following events:" and 10.2.2 continues, "All actions taken by any individual with root or ...
- 538
1
vote
1
answer
2k
views
inactive option not working for pam_lastlog.so
I'm trying to set up my system to lock out inactive users after 10 days. I'm using CentOS 6.x, and looking at RHEL manual, this is what I found:
To lock out an account after 10 days of inactivity, ...
- 5,257
1
vote
2
answers
1k
views
How do you configure postfix to only try unencrypted email with a fix list of IP address/domains?
A PCI scan told me to stop using TLS 1.0 for e-mail. I'm using postfix, so I disabled TLS 1.0, and all traffic for 1.0 stopped. Then the next day I looked at the logs and I see a lot of this...
...
- 173
-1
votes
1
answer
728
views
SSL Certificate - Self-Signed Certificate
I'm trying to get PCI compliant and the PCI scanning company is showing below Fail scan report
SL Certificate - Self-Signed Certificate SSL Certificate - Self-Signed
Certificate port 25/tcp over ...
- 131
-1
votes
1
answer
250
views
What's blocking the PCI compliance scanner from scanning my site? [closed]
(I am not sure if this question fits in serverfault.com. If not, forgive me.)
I maintain my client's ecommerce website and the credit card processing company requires PCI compliance. For that, our ...
- 873
5
votes
0
answers
514
views
Virtual terminal PCI compliance
The PCI DSS compliance rules say that if we use any computers to take card payments via a web based virtual terminal, then those PCs must be isolated from the rest of the IT network (otherwise the ...
- 151
30
votes
3
answers
42k
views
Disable TLS 1.0 in NGINX
I have a NGINX acting as a reverse proxy for our sites and is working very well. For the sites that need ssl I followed raymii.org to make sure to have as strong of a SSLLabs score as possible. One of ...
- 403
0
votes
1
answer
330
views
XSS Vulnerability with PCI RapidComply
I have a website hosted on an Apache Tomcat 7 server that uses the Authorize.net gateway and merchant services to handle payment. I recently ran a required PCI Compliance test against my website, and ...
- 103
1
vote
1
answer
149
views
Apple Mail , Kerio connect and TLSv1 disabled
Due to PCI-DSS now requiring that TLSv1 is disabled to pass our network scan I have the following issue.
Using
Kerio Connect mail server (www.kerio.co.uk)
Apple Mail (yosemite and all the way down ...
- 131
0
votes
2
answers
138
views
NGNIX, SSL Certificates and PC-DSSI 3.1
We are going to have to pass a PCI 3.1 audit for the web application we're currently developing. It's on Amazon EC2 running NGINX under Debian.
We're in contact with Symantec for certificates and we'...
- 522
1
vote
1
answer
11k
views
Windows Server 2012 R2 IIS Weak Ciphers Reported After Lockdown
I am having issues getting a windows server 2012 R2 64-bit box locked down. I used a tool called IISCrypto to make the box FIPS 140 compliant.
I have manually checked the registry entries and all the ...
- 13
53
votes
9
answers
211k
views
How do I disable TLS 1.0 without breaking RDP?
Our credit card processor recently notified us that as of June 30, 2016 we will need to disable TLS 1.0 to remain PCI compliant. I tried to be proactive by disabling TLS 1.0 on our Windows Server 2008 ...
- 1,271
3
votes
1
answer
245
views
Password policies for Google Cloud Platform
Is there a way to set password policies for accounts accessing a project on Google Compute Platform? Specifically, I need to meet the PCI-DSS requirements, which include things that pam would ...
google-cloud-platform
1
vote
0
answers
203
views
Tracking user activity in openvz container?
I have been trying to figure out a way to track user activity in an openvz container for a long time now (auditd like in KVM's). This is a PCI-DSS requirement. I can't seem to find any good ...
- 11