Linux Admin Zone

To tighten security or again to pass PCI test, you can disable weak SSL cipher. Let’s do it in a host running lighttpd web server in CentOS Linux.

Normally, you get message like this for this issue:

Synopsis : The remote service supports the use of medium strength SSL ciphers. Description : The remote host supports the use of SSL ciphers that offer medium strength encryption, which we currently regard as those with key lengths at least 56 bits and less than 112 bits.
 
Note: This is considerably easier to exploit if the attacker is on the same physical network. Solution: Reconfigure the affected application if possible to avoid use of medium strength ciphers. Risk Factor: Medium / CVSS Base Score : 4.3 (CVSS2#AV:N/AC:M/Au:N/C/I:N/A:N)

Let’s disable these weak cipher’s now:

Update config file to add or modify following lines. After addition/editing, lines should look like this:

$ vi /etc/lighttpd/lighttpd.conf
ssl.use-sslv2 = "disable"
ssl.cipher-list = "TLSv1+HIGH !SSLv2 RC4+MEDIUM !aNULL !eNULL !3DES @STRENGTH"

make sure that you have to put these lines in any blocks/vhosts etc. also because these are global options and if you not put these in vhosts blocks, then they will not be effective.

This is again short post for people lazy enough to not compile and always looking for some quick way to upgrade/install software.

The machine is having CentOS 5.2 and httpd 2.2.8. We are looking to upgrade httpd to 2.2.17 to succeed in PCI compliance. While I assured that current Apache is having all security upgrades but still test guys saying we have to upgrade to latest stable. Ok, its not that difficult.

When I checked, almost all common repositories are having upgrades up to 2.2.8 which I did but I need it to latest stable which is 2.2.17 while writing this article. Then I noticed CentAlt repo which is having this upgrade.

In a CentOS 5.2 Server, there PHP 5.2.4 and due to which PCI complaince test failed. We were in requirement to upgrade PHP to latest stable version. While writing this article, we found 5.3.5 as latest stable release of PHP. Describing here the steps taken to download, install PHP 5.3.5.

Step 1. Check existing PHP modules and Install pre-requisites libraries/apps

As the first step, you should get list of installed PHP modules so that you can incude them with newer PHP as well otherwise functionality of your site/application can break.

Get list of all PHP module installed in Server:

HAProxy is a very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It’s free and open source application which is very lightweight as well. I checked few other alternatives like perlbal, pond etc. but found haproxy most competent performer.

I’m describing here the steps I followed to download, install and configure it in Ubuntu Server. We have 2 backend Web servers which will receive traffic from Load balancer host running HAProxy in front of them.

Step 1. Download, compile and install HAproxy from here :

$ cd /usr/src
$ wget http://haproxy.1wt.eu/download/1.4/src/haproxy-1.4.11.tar.gz
$ tar xzf haproxy-1.4.11.tar.gz 
$ cd haproxy-1.4.11
$ make install