Resolved PCI compliance for plesk 12.5

[nisamudeen97]

Hi,

I have followed PCI doc http://docs.plesk.com/en-US/12.5/ad...ce/tune-plesk-to-meet-pci-dss-on-linux.65871/ for passing pci compliance. Meanwhile while doing online scan it is showing "FTP server allow plain text authentication". Please check the screen shot attached.

To allow only FTPS connections to your server: I have already done the below.
Go to Tools & Settings > Security Policy.
Select the option Allow only secure FTPS connections for FTP usage policy.

How can is disable plain text authentication for FTP ? Is that possible

 

[Lloyd_mcse]

Hi nisamudeen97
so you ran the PCI Compliance resolver, but your scan still shows plain text available on ProFTP?
Well, I see two possibilities...

1) The scan is showing a false positive.
2) For some reason TLSRequired is still set to off
check the files...

/etc/proftpd.conf
/etc/proftpd.d/ssl.conf

TLSRequired off

and change it to on...

TLSRequired on

Save the file and restart xinetd...

# service xinetd restart

I hope that helps
Kind regards

Lloyd

 

[nisamudeen97]

Hi,

Thanks for the advise. I think it is false positive. I am only able to connect to the server via FTP on TLS method. No other methods works. So it is the most secured one. Planning to proceed with paid PCI scan.

 

[IgorG]

JFYI, we have released new Plesk Security Advisor extension - https://www.plesk.com/2016/07/13/plesk-security-advisor-extension/

 

[Jorge Batres]

Hi, I cannot get rid of the DES /3DES ciphers on Plesk Onix with RedHat 6.8 and postfix. I keep testing the server for PCI compliance and block 64 ciphers keep showing no matter what. I have ran the plesk sbin pci_compliance_resolver --enable, but is tries to update Qmail and I'm not using that. Can you please tell me where can I disable those ciphers server wide so they don't show on ports 21, 993, 995 and 8443.
In a different scan, "cleartext logins permitted" shows on ports 25, 110 and 465, and the ciphers show on ports 110, 143, 443, 465, 993, 995 and 8443.

Please help,

Jorge.

 

[UFHH01]

Hi Jorge Batres,

pls. consider to read and follow:

How to pass PCI compliance scan? ( KB - article 130232 )

and pls. don't forget to read and follow as well:

Tune Plesk to Meet PCI DSS on Linux ( Plesk Onyx ( 17.0 ) - online documentation - Advanced Administration Guide, Plesk for Linux )​

If the recommended ciphers - list from Plesk is not enough for your needs and goals, pls. consider to use your very own ciphers - list, when you use "plesk sbin sslmng ...".
( You might find it usefull to use a "generator", to create your unique ciphers - list, so I can recommend the Mozilla SSL Configuration Generator at: => https://mozilla.github.io/server-side-tls/ssl-config-generator/ )

In a different scan, "cleartext logins permitted" shows on ports 25, 110 and 465, and the ciphers show on ports 110, 143, 443, 465, 993, 995 and 8443.

The commands and informations, how to disable PLAIN TEXT authentication is described in the above linked documents.