On this post we are going to show how to quickly patch a common PCI Vulnerability Alert that says something like this:
\n\u201cThe remote service appears to encrypt traffic using SSL protocol version 2?.<\/p>\n
In Apache common ports 80 and 443, you need to modify the SSLCipherSuite directive in the httpd.conf or ssl.conf file.
\nAn example would be editing the following lines to something like:<\/p>\n
1.
\n SSLProtocol -ALL +SSLv3 +TLSv1
\n 2.
\n SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP<\/p>\n
After you have done this, if you see you are still getting PCI Compliance vulnerability emails regarding to this issue its probably that cPanel is still allowing SSLv2 on their ports.<\/p>\n
To quickly disable SSL version 2 on cPanel ports: 2082, 2083, 2086, 2087, 2095, 2096. You will need to do the following:<\/p>\n
edit \/var\/cpanel\/cpanel.config and change nativessl=1 to nativessl=0<\/p>\n
This will make cPanel to use sTunnel.<\/p>\n
edit \/usr\/local\/cpanel\/etc\/stunnel\/default\/stunnel.conf<\/p>\n
and add:<\/p>\n
1.
\n options = NO_SSLv2<\/p>\n
just below the \u201cAuthentication stuff\u201d tab.<\/p>\n
After you have done all this you will need to restart cPanel:<\/p>\n
1.
\n \/etc\/init.d\/cpanel restart<\/p>\n
Done!<\/p>\n
How to quickly check this?<\/p>\n
SSH to your server and type the following commands<\/p>\n
1.
\n root@cPanel [~]# openssl s_client -ssl2 -connect localhost:2096
\n 2.
\n root@cPanel [~]# openssl s_client -ssl2 -connect localhost:2083
\n 3.
\n root@cPanel [~]# openssl s_client -ssl2 -connect localhost:2087
\n 4.
\n root@cPanel [~]# openssl s_client -ssl2 -connect localhost:2086<\/p>\n
If everything is fine you should receive something like this,<\/p>\n
1.
\n root@cPanel [~]# openssl s_client -ssl2 -connect localhost:2096
\n 2.
\n CONNECTED(00000003)
\n 3.
\n write:errno=104<\/p>\n","protected":false},"excerpt":{"rendered":"
On this post we are going to show how to quickly patch a common PCI Vulnerability Alert that says something like this: \u201cThe remote service appears to encrypt traffic using SSL protocol version 2?. In Apache common ports 80 and 443, you need to modify the SSLCipherSuite directive in the httpd.conf or ssl.conf file. An… <\/p>\n