远程服务支持在 PCI 扫描中使用中等强度的 SSL 密码错误
当我的服务器进行 PCI 合规性扫描时，我收到此错误。我想知道是否可能是因为我关闭了 iptables。我不想让他们再次扫描，直到我确信它会通过。我的第一个问题是，有什么办法可以自己扫描吗？我的另一个问题是，关闭 iptables 是否是实际问题？
以下是我收到的一些错误：
- TCP 443 https - 远程服务支持使用弱 SSL 密码
- TCP 465 urd - 远程服务接受使用 SSL 2.0 加密的连接
- TCP 993 imaps - 远程服务使用以下协议加密流量已知弱点
- TCP 995 pop3s - 远程服务接受使用 SSL 2.0 加密的连接
感谢您的宝贵时间。
I received this error when my server was scanned for PCI compliance. I was wondering if it may be because I shut off iptables. I do not want to ask them to scan it again until I am sure that it will pass. My first question is, is there any way to scan for this myself? My other question is, does iptables being turned off the actual problem?
Below are just a few errors I am getting:
- TCP 443 https - The remote service supports the use of weak SSL ciphers
- TCP 465 urd - The remote service accepts connections encrypted using SSL 2.0
- TCP 993 imaps - The remote services encrypts traffic using a protocol with known weaknesses
- TCP 995 pop3s - The remote service accepts connections encrypted using SSL 2.0
Thanks for your time.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这些错误与 iptables 没有任何关系 - 它们表明突出显示的服务被配置为以弱或不安全的方式支持 SSL。
但是，如果您不打算向外界提供邮件服务，那么您应该分别禁用在端口 465、993 和 995 上运行的 SMTPS、IMAPS 和 POP3S 服务（或使用 iptables 阻止它们）。
此外，假设您确实打算提供 HTTPS 服务，您将需要修复您正在侦听的 Web 服务器的 SSL 配置。您需要将其配置为仅支持 TLS 1.0 连接和强密码。如需有关此问题的帮助，ServerFault 是正确的站点。
The errors are not specifically anything to do with iptables - they are indicating that the highlighted services are configured to support SSL in a weak or insecure manner.
However, if you do not intend to provide mail services to the outside world, then you should be disabling the SMTPS, IMAPS and POP3S services running on ports 465, 993 and 995 respectively (or blocking them with iptables).
In addition, presuming that you do intend to provide HTTPS services, you will need to fix the SSL configuration of the web server that you have listening. You will want to configure it to support only TLS 1.0 connections, and only strong ciphers. For help with this, ServerFault is the right site.
如果您使用 Apache，则需要调整 ssl.conf 文件中的一些设置。重要的是 SSLProtocol 和 SSLCipherSuite。以下设置对我有用，但是 YMMV。您可能需要将这些添加到您站点的 VirtualHost 容器中，而不是简单地调整默认容器中的现有容器。
尝试这些，然后使用下面的扫描工具之一进行免费扫描，以查看您的网站提供哪些密码...
https://www.ssllabs.com/ssldb/index.html
http://www.serversniff.net/content.php?do=ssl
http://www.sslshopper.com/ssl-checker.html
If you are using Apache you need to adjust some settings in your ssl.conf file. The important ones are SSLProtocol and SSLCipherSuite. The following settings worked for me but YMMV. You may need to add these to the VirtualHost container for your site and not simply adjust the existing ones in the default container.
Try these and then use one of the scanning tools below to do a free scans to see what ciphers your site is making available...
https://www.ssllabs.com/ssldb/index.html
http://www.serversniff.net/content.php?do=ssl
http://www.sslshopper.com/ssl-checker.html