PCI Compliance and openssl-1.0.0c

PCI Compliance and openssl-1.0.0c

ContributeSubmit an ArticleSubmit a Poll Current Poll

Which software do you use for processing RAW images?

aperture
dcraw
lightroom
rawstudio
rawtherapee
ufraw
ufraw-batch

( 82 votes ~ 4 comments )

Recent Weblogs PHP, MySQL, and SSL? by dkg 9 comments A new book on shell scripting by kumanna 1 comment Reboot with a broomstick, a piece of gum, and tape by emeitner Lost with the sendmail.conf system by jesperkp 4 comments automated file deletion by sajidgilani 1 comment [error] (9)Bad file descriptor: apr_socket_accept: by simonw Why do upgraded servers not come back from reboot? by lykwydchykyn 4 comments I have a Debian box again by blackm 1 comment How to forward UDP Broadcasts? by mag whiteboard.debian.net by rkd 1 comment More Weblogs Archived Weblogs Debian Administration System Administration Tips and Resources [ About | Adverts | Archive | FAQ | Hall of Fame | Search | Tag Cloud | PCI Compliance and openssl-1.0.0c

Posted by SpiesInOrbit on Wed 9 Mar 2011 at 08:20

function addTag(url){ $("#current_tags").load( url, function() { $("#new_tag").val( "" ) $("#add_tag").hide() })} $(document).ready(function(){ $("#new_tag").autocomplete("/ajax.cgi?tag_complete=1;"); $('a#toggle').click(function() { $('#add_tag').toggle(400); })} ) Tags: openssl, pci compliance

For some, the stable biased Debian is too conservative and apparently OpenSSL has a bug that breaks PCI compliance.

CVE-2009-1379 CVE-2010-4180 CVE-2010-4252

For e-commerce sites this can be an issue. Due to recent changes in the credit card laws all sites accepting credit cards must meet PCI compliance. Its my opinion this is a poor upgrade path for security, since truly, openssl should patch version 0.9.8o-4, rather than require a version change. Either way openssl-1.0.0c is only available through the experimental repositories.

Addition of the following source to /etc/apt/sources.list.d/openssl-1.0.0c

deb http://ftp.debian.org/debian experimental main

followed by:

apt-get updateapt-get -t experimental install openssl

This is where I thought the crisis would end...

Apparently, you have to compile openssl-1.0.0c from source and include ssl v2, because apache2 2.2.16 won't compile without it and openssl-1.0.0c excludes it by default.

cd /usr/srcapt-get source openssl=1.0.0c-2apt-get source apache2cd openssl-*apt-get build-dep openssl=1.0.0c-2

Now we have to enable sslv2. I'm still learning the package manager protocol, so someone feel free to jump in here with some "best practices". Edit 'debian/rules'.

vi debian/rules# -- change --CONFARGS = --prefix=/usr --openssldir=/usr/lib/ssl \no-idea no-mdc2 no-rc5 zlib enable-tlsext no-sslv2# -- to --CONFARGS = --prefix=/usr --openssldir=/usr/lib/ssl \no-idea no-mdc2 no-rc5 zlib enable-tlsext# Now we need to build the packages again.debuild -us -uc

I advise using GNU screen here because its nice to be able to disconnect and do something else while it compiles.

Now we need to compile apache2 with the new openssl libs.

cd ../apache2-*vi debian/rules# -- change --AP2_CFLAGS = $(CFLAGS) -g -pipe -I/usr/include/xmltok \-I/usr/include/openssl -Wall -Wformat -Wformat-security \-D_FORTIFY_SOURCE=2 -fstack-protector# -- to --AP2_CFLAGS = $(CFLAGS) -g -pipe -I/usr/include/xmltok \-I/usr/src/openssl-1.0.0c/include/openssl -Wall -Wformat \-Wformat-security -D_FORTIFY_SOURCE=2 -fstack-protector

Now we need to compile apache2.

apt-get build-dep apache2debuild -us -uccd ..dpkg -i apache2.2-bin_2.2.16-6_amd64.deb \apache2.2-common_2.2.16-6_amd64.deb \apache2-utils_2.2.16-6_amd64.deb# for me I using prefork because of phpdpkg -i apache2-mpm-prefork_2.2.16-6_amd64.deb

This should restart apache. You can check the install with phpinfo(). Please Note, you will have to disable SSLv2 since it has weak ciphers. This can be done by adding appending '-SSLv2' to the following line in your ssl.conf.

vi /etc/apache2/mods-avaliable/ssl.confSSLProtocol all -SSLv2service apache2 restart

After the restart you should be good with ssl and PCI Compliance

Add Comment Printable version

 

<<< Creating dynamic volumes with loop devices

Why are these adverts here?

#1 Re: PCI Compliance and openssl-1.0.0c Posted by Anonymous (193.252.xx.xx) on Wed 9 Mar 2011 at 11:51
All those bugs are fixed in Debian:
security-tracker.debian.org/tracker/CVE-2010-4252
security-tracker.debian.org/tracker/CVE-2009-1379
security-tracker.debian.org/tracker/CVE-2010-4180

There is absolutely no need to use experimental! Juste use stable and stable security. [ Parent | Reply to this comment ]

#2 Re: PCI Compliance and openssl-1.0.0c Posted by Anonymous (76.186.xx.xx) on Thu 10 Mar 2011 at 06:17
That's how I explained it to the auditing company. I also included a mention of the uncertainty and overhead of running a mixed system with what's considered untested software. I'm still waiting for their response. Until then, Experimental is holding the pci scanner at bay and keeping the certification image showing on the site. [ Parent | Reply to this comment ]

Articles and comments are the property of their respective posters.

Trademarks are the property of their respective owners.
Debian is a registered trademark of Software in the Public Interest, Inc.

This site is copyright © 2004-2010 Steve Kemp.
Site hosting provided by Bytemark Hosting.

Email: webmaster@debian-administration.org

Article Feeds in Atom, RSS, & RDF formats

User Login

Username:

Password:

[ Advanced Login ]

Register Account

Flattr Sponsored Links

Why are these adverts here?

Quick Site Search