2

I run a small e-commerce website hosted on a dedicated server with Debian 6 Squeeze.

I need to become PCI compliant (the card industry standard for security).

Therefore I have registered with TrustWave TrustKeeper which scans my site for potential security vulnerabilities.

The scan reported plenty of vulnerabilities and I need to upgrade PHP (which I did) and Apache. The issue is that the Apache version which is recommended is not available for Debian 6.

It's becoming a nightmare to fix all the reported issues.

Are you aware of a Distribution that would be pre-configured to be PCI compliant ? Some kind of perfect settup with Apache/MySQL/PHP/SSL/eMail: IMAP & SMTP-SSL.

Thanks for your help.

Improve this question
1
  • Please check your terminology. Breaches are break-ins. Vulnerabilities are ways to break in. Trustwave reported several vulnerabilities, not breaches... unless you went beyond the Trustwave ASV scans and hired them to come in and do forensics.
    – Rod MacPherson
    Nov 28, 2013 at 0:15

2 Answers 2

Reset to default
2

Normally the version of Apache within Debian squeeze should be up-to-date with all security patches. This means that the version itself might run behind but that all security updates have been applied in form of backported fixes (this is often done by Debian).

You should follow a hardening guide as well, most of these Trustwave vulnerability reports solely depend on the advertised HTTP headers. Hardening guides will also help you in making your setup more secure as you expose less information about your setup.

Improve this answer
2
  • The versions reported by the backports are definitely the issue. Trustwave should have some method for disputing false positive vulnerabilities by supplying evidence. The same evidence will apply for all future scans so while the process can be annoying and time consuming, it should be straight forward.
    – freb
    Nov 27, 2013 at 21:50
  • When I used Nexpose, I had that problem with Red Hat - they backport security fixes, so the scanner always found a "vulnerable" version number. It's kind of an endemic problem.
    – gowenfawr
    Nov 28, 2013 at 1:32
0

Distributions like Gentoo and Arch (no specific releases, just continuous updates of all packages) usually have most recent versions but there can still be these same kinds of issues.

I had OpenSSH 6.1 installed on one of my Gentoo servers, and the banner clearly stated 6.1, but the security scanner insisted we needed to upgrade past OpenSSH 2. The funny part is later in the same report it properly identified the OpenSSH version.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .