PCI Compliance

As someone with a couple of decades of enterprise hosting experience, I'd have to disagree with that. The scan vendor's job is to check for vulnerabilities and report them back. The server admin, provider, and/or software vendor is responsible for fixing their vulnerabilities.

Anywho... To help:

In the first case the "vulnerability" is kind of interesting. The server itself is not vulnerable at all and the attack requires a compromised browser. It seems that most of the PCI scan vendors are triggering on this if any cipher other than RC4 is in use. This could be an issue with about 0.09% of the internet connecting to you (the better bet is to allow for fallback to a CBC based cipher if RC4 isn't supported, but the scan vendors aren't allowing this.).

The fix in cPanel's poorly implemented SSL configuration via cpanel would be to:
Go to Service Configuration ->Apache Configuration -> Global Configuration
Select the custom value for SSL Cipher Suite and set it to: RC4-SHA:HIGH:!ADH:!AES256-SHA:!ECDHE-RSA-AES256-SHA384:!AES128-SHA:!DES-CBC3-SHA:!DES-CBC3-MD5:!IDEA-CBC-SHA:!RC4-MD5:!IDEA-CBC-MD5:!RC2-CBC-MD5:!MD5:!aNULL:!EDH:!AESGCM

It's also best if you add these two lines to your /usr/local/apache/conf/includes/pre_main_global.conf
# CVE-2011-3389
SSLHonorCipherOrder On
SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown


Then run the following commands:
/usr/local/cpanel/bin/build_apache_conf
/etc/init.d/httpd restart

Rerun your scan and you should be set on the BEAST attack stuff.


The second is something that's pretty annoying to server admins with cpanel-type installations. The major problem here is that you have mail running on the SSL site IP. I recommend pointing the domain's email to a dedicated mail IP and firewalling out email to the SSL IP. To just pass this scan you can likely go to Service Configuration ->Exim Configuration Manager ->Basic Editor ->Security and turn "Require clients to connect with SSL or issue the STARTTLS command before they are allowed to authenticate with the server" ON. Note: any clients sending mail using that IP will need to make sure they have encrypted authentication turned on in their client.

Regards,

Doug

 

actually for the Beast attach which is what Security Metrics is failing folks over its an isse that needs to be addressed by cPanel NOT Security Metrics and there is a bug report in about it
The issue is that cpanel says that SM shouldnt be scanning for it, and SM says its a valid issue.

So the documents that were linked to are absolutly worthless