In Progress

PCI DSS compliance on Linux server running PLESK.

Hello experts,

I have a project that I need completed. I have a linux server that is running Plesk that was PCI DSS compliant when I first signed up about 5 months ago but the latest scan shows some failure messages which I have posted below:

TCP 443 https 5 Synopsis : The remote service supports the use of weak SSL ciphers. Description : The remote host supports the use of SSL ciphers that offer either weak encryption or no encryption at all. See also : [url removed, login to view] .html Solution: Reconfigure the affected application if possible to avoid use of weak ciphers. Risk Factor: Medium / CVSS Base Score : 5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)

TCP 993 imaps 5 Synopsis : The remote service supports the use of weak SSL ciphers. Description : The remote host supports the use of SSL ciphers that offer either weak encryption or no encryption at all. See also : [url removed, login to view] .html Solution: Reconfigure the affected application if possible to avoid use of weak ciphers. Risk Factor: Medium / CVSS Base Score : 5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)

TCP 995 pop3s 5 Synopsis : The remote service supports the use of weak SSL ciphers. Description : The remote host supports the use of SSL ciphers that offer either weak encryption or no encryption at all. See also : [url removed, login to view] .html Solution: Reconfigure the affected application if possible to avoid use of weak ciphers. Risk Factor: Medium / CVSS Base Score : 5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)

TCP 443 https 4 Synopsis : The remote service encrypts traffic using a protocol with known weaknesses. Description : The remote service accepts connections encrypted using SSL 2.0, which reportedly suffers from several cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients. See also : [url removed, login to view] Solution: Consult the application's documentation to disable SSL 2.0 and use SSL 3.0 or TLS 1.0 instead. Risk Factor: Medium / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)

TCP 993 imaps 4 Synopsis : The remote service encrypts traffic using a protocol with known weaknesses. Description : The remote service accepts connections encrypted using SSL 2.0, which reportedly suffers from several cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients. See also : [url removed, login to view] Solution: Consult the application's documentation to disable SSL 2.0 and use SSL 3.0 or TLS 1.0 instead. Risk Factor: Medium / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)

TCP 995 pop3s 4 Synopsis : The remote service encrypts traffic using a protocol with known weaknesses. Description : The remote service accepts connections encrypted using SSL 2.0, which reportedly suffers from several cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients. See also : [url removed, login to view] Solution: Consult the application's documentation to disable SSL 2.0 and use SSL 3.0 or TLS 1.0 instead. Risk Factor: Medium / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)

I'd like all these fixed to I can pass the PCI DSS tests and so I'm nice and secure.

The server is a dedicated server that runs Plesk and it runs a number of web sites so it is of ABSOLUTE IMPORTANCE that Plesk does not get broken in the process.

There are two tests that run and fail. One is for the actual server and the other is for a web site that sits on the server.

I look forward to hearing from someone soon.

My kindest regards

Richard Georgiou

Skills: Linux, System Admin

See more: reconfigure affected application possible avoid use weak ciphers, plesk tls weak ciphers, ssl ciphers offer weak encryption plesk pci, remote service supports use weak ssl ciphers, web consult, weaknesses, system tests, service experts, one up communications, linux 4.5, experts solution, b&l communications, b&c compliance, 3 weaknesses, linux encryption dss, plesk pci compliant, pop3s pci compliance, linux pci dss encryption server, linux compliance server, pci compliance ssl ciphers 993, ssl server accepts weak ciphers plesk, plesk pci dss, disable use plesk, ciphers plesk, pci dss plesk

About the Employer:
( 9 reviews ) Buxted, United Kingdom

Project ID: #576703

Awarded to:

t3nt3tion

I checked your project details, and I`ve sent you a private message with some information.

$150 USD in 2 days
(9 Reviews)
4.2

13 freelancers are bidding on average $147 for this job

dmarc

Please check PM.

$200 USD in 2 days
(1 Review)
7.2
shakoush2001

Hi I am a CCNA,MCSA,Linux+ and a CEH. I do have 5+ years experience in Linux System Administration and I do specialize in Debian systems. I have experience in a high availability environment with 40+ servers and more t More

$199 USD in 3 days
(78 Reviews)
6.4
jeeves82

Please check PM.

$125 USD in 1 day
(42 Reviews)
6.2
musashi42

Hi, I am ready. Please check my profile for references and Your PM(INBOX) for more details. Thank You.

$200 USD in 3 days
(6 Reviews)
4.9
infyagent

Hi, Please see Private Message Board for further details. -Infysecagents

$200 USD in 5 days
(5 Reviews)
4.2
dfk

Hi I have done _exactly_ this on my own server as I accept card payments on my server which also runs plesk. The one port which normally gets picked up is 8443...as the PCI DSS compliance folks dont realise that More

$200 USD in 1 day
(13 Reviews)
4.0
itbusinessuy

Hi, We have done this kind of tasks in the past for Mcfee PCI compliance tests. The issues that you list are really easy to fix and all are related to the use of weak SSL encryption, this is a quick and easy job tha More

$50 USD in 0 days
(16 Reviews)
3.7
simarsharma

Details in pmb. Regards, Sim

$150 USD in 2 days
(9 Reviews)
3.1
nickProfessional

Hi, I would like to help you on the issues, let me have a look. Nick

$200 USD in 5 days
(1 Review)
2.0
dbavale

I am linux security expert having more than 9 years of experience. I can fix this for you.

$40 USD in 7 days
(1 Review)
0.0
PerfSys

Hi, We have numbers of successful PCI DSS Level-1 (Processing centers) certifications. Will be glad to assist you!

$100 USD in 1 day
(0 Reviews)
0.0
zorlac

I can take care of this for you. I've been through two intense PCI audits (performed by VISA) in the last two years for a multi-billion dollar corporation in the US. My diligence and supporting paperwork (very importan More

$150 USD in 1 day
(0 Reviews)
3.4
sathishbob

HI, We are a group of 3 senior software engineers who is working with leading MNC'[url removed, login to view] have a developer, system admin and a network admin. I previously worked with CA which also offers pci compliance scan. we hav More

$150 USD in 7 days
(0 Reviews)
0.0