Forumitbr.com.br

Description

The remote host supports the use of RC4 in one or more cipher suites.
The RC4 cipher is flawed in its generation of a pseudo-random stream of bytes so that a wide variety
of small biases are introduced into the stream, decreasing its randomness.
If plaintext is repeatedly encrypted (e.g., HTTP cookies), and an attacker is able to obtain many
(i.e., tens of millions) ciphertexts, the attacker may be able to derive the plaintext.

Solution

Reconfigure the affected application, if possible, to avoid use of RC4 ciphers. Consider using TLS 1.2
with AES-GCM suites subject to browser and web server support.

Solução SecurityCenter:

/opt/sc4/support/conf/sslciphers.conf

# SSL Ciphers
# Antigo
# SSLCipherSuite DES-CBC3-MD5:RC2-CBC-MD5:RC4-MD5:DES-CBC3-SHA:RC4-MD5:RC4-SHA:DES-CBC3-SHA:AES128-SHA:AES256-SHA:RC4-MD5:RC4-SHA
# Novo
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS...

Description

The HTTP headers provided by the remote web server provide information
that could aid an attacker such as the server version and languages used by the web server.

Solution

Modify the HTTP headers of the web server to not disclose detailed
information about the underlying web server.

Resolução do problema base CentOS / Red Hat Linux rodando servidor Apache

/usr/sbin/httpd -V

Para descobrir qual conf esta sendo utilizado

Editar /etc/httpd/conf/httpd.conf e deixar como:

ServerTokens Prod
ServerSignature Off

/etc/init.d/httpd reload
/etc/init.d/httpd restart

Description

The remote web server does not set an X-Frame-Options response header
in all content responses. This could potentially expose the site to a
clickjacking or UI Redress attack wherein an attacker can trick a user
into clicking an area of the vulnerable page that is different than
what the user perceives the page to be. This can result in a user
performing fraudulent or malicious transactions.

X-Frame-Options has been proposed by Microsoft as a way to mitigate
clickjacking attacks and is currently supported by all major browser vendors.
Note that while the X-Frame-Options response header is not the only mitigation
for clickjacking, it is currently the most reliable method to detect through automation.
Therefore, this plugin may produce false positives if other mitigation strategies
(e.g frame-busting JavaScript) are deployed or if the page does not perform any
security-sensitive transactions.

Solution

Return the X-Frame-Options HTTP header with the page's response....

Description

The remote service accepts connections encrypted using SSL 2.0 and/or SSL 3.0.
These versions of SSL are affected by several cryptographic flaws.
An attacker can exploit these flaws to conduct man-in-the-middle attacks or to decrypt communications
between the affected service and clients. NIST has determined that SSL 3.0 is no longer acceptable
for secure communications. As of the date of enforcement found in PCI DSS v3.1, any version of SSL
will not meet the PCI SSC'S definition of 'strong cryptography'.

Solution

Consult the application's documentation to disable SSL 2.0 and 3.0. Use TLS 1.1 (with approved cipher suites) or higher instead.

Resolução do problema base CentOS / Red Hat Linux

Editar /etc/httpd/conf.d/ssl.conf e procurar pela linha: # SSL Protocol support

Setar como ( dependendo da versão do SO )

RHEL 7.x:

SSLHonorCipherOrder On
SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2

RHEL 6.x:

SSLHonorCipherOrder On
SSLProtocol -All +TLSv1 +TLSv1.1...

Description

Description

The SSH server is configured to allow either MD5 or 96-bit MAC algorithms,
both of which are considered weak. Note that this plugin only checks for the options
of the SSH server and does not check for vulnerable software versions.

Solution

Contact the vendor or consult product documentation to disable MD5 and 96-bit MAC algorithms.

Resolução do problema base CentOS / Red Hat Linux

Editar o /etc/ssh/sshd_config e adicionar:

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,arcfour
MACs hmac-sha1,hmac-ripemd160

/etc/init.d/sshd reload
/etc/init.d/sshd restart

Description

The remote SSH server allows connections with one or more Diffie-Hellman moduli less than or equal to 1024 bits.
Through cryptanalysis, a third party can find the shared secret in a short amount of time (depending on modulus size and attacker resources).
This allows an attacker to recover the plaintext or potentially violate the integrity of connections.

Solution

Reconfigure the service to use a unique Diffie-Hellman moduli of 2048 bits or greater.

Válido somente para CentOS e Red Hat Linux versões 6 e 7
Versão 5 não recebeu suporte a este incidente, recomendação é upgrade de versão do SO

Resolução do problema base CentOS / Red Hat Linux

cp /etc/ssh/moduli /etc/ssh/moduli.backup
awk '$5 > 2000' /etc/ssh/moduli > /usr/src/moduli
mv /usr/src/moduli /etc/ssh/moduli

Editar: /etc/ssh/sshd_config e adicionar:

KexAlgorithms...

Error:  Multilib version problems found. This often means that the root
cause is something else and multilib version checking is just pointing out that there is a problem.

Problema ocorre devido a pacotes de plataforma x86 não utilizados,
rodar os seguintes comandos para resolver:

Resolução do problema base CentOS / Red Hat Linux

yum install yum-utils
package-cleanup --dupes
package-cleanup --cleandupes
yum clean all
yum update

Olá pessoal,

Participei de um podcast do Na Porteira Cast, sobre segurança na internet, que faz parte do nosso projeto social denominado Segurança em Simples Atos , que pode ser acessado em: segurancaemsimplesatos.com.br

Se quiserem ouvir, segue o link do podcast:

Abrs,
Até mais ;)
www.debsolutionsti.com

Video interessante sobre a certificação CISSP.

:o

Prezados, Boa Noite,

Alguém pode me recomendar cursos na área de segurança em servers Linux e Server 2008, tanto online quanto presencial, moro em fortaleza.

Abraço a todos.