Author: Michael Blood

PCI Updates that ‘might’ help your system pass TrustWave scans

I have written another article of apache commands that might make website more PCI compliant.

This is another task based on that article,  but this goes a little further to address some additional securiity scans that TrustWave does.

In addition to these configuration in apache,  you should also put some items into your .htaccess file.

If your site allows both port 80 and 443,  make sure your forward all port 80 requests to 443 so scanners dont bark about you allowing non secure access to the site.

RewriteEngine On

ReWriteCond %{SERVER_PORT} !^443$
RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [NC,R,L]

If you have an FTP server that is open to all FTP addresses,  consider locking it down to IP Addresses for specific developers (If you dont have a static IP Address,   get one!)

<Limit LOGIN>
 Order allow, deny
 Allow from w.x.y.z/32
 Allow from w.x.y.0/24
 DenyAll
</Limit>

You will want to make sure you have already installed firewall rules which limit services to only your IP addresses like in this post

Make sure you install / upgrade to the latest apache2  executable (as of 10/15 the minimum needed to pass tests is 2.2.31)

apt-get update
apt-get install apache2

Update the /etc/apache2/apache2.conf file to not expose the apache version

ServerTokens ProductOnly
ServerSignature Off

Update your SSL Cipher settings in Apache2.conf to exclude some additional ciphers that are considered insecure

SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA !ECDHE-RSA-AES256-SHA !ECDHE-RSA-AES256-SHA !ECDHE-RSA-AES256-SHA !ECDHE-RSA-AES256-SHA !DHE-RSA-AES128-SHA !DHE-RSA-SEED-SHA !DHE-RSA-CAMELLIA128-SHA !ECDHE-RSA-RC4-SHA !DHE-RSA-AES256-SHA !DHE-RSA-CAMELLIA256-SHA !ECDHE-RSA-AES128-SHA !RC4-SHA !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"

Note,  the SSL Cipher list above was generated from a list that was created for a previous article for updates to apache.  At the that article helped pass a different PCI scan.  Since this PCI scan is newer and obviously more in depth,  the list of excluded ciphers has increased.

I came up with the list above by reading the ‘Evidence’ column of the TrustWave report and then specifically excluding the listed Ciphers by putting  an ! in front of it.   As new reports come out and additional ciphers are marked insecure,  we will add additional ciphers to the apache files in the same way: