Hey all, we had a 3rd party company come in to check security, etc. and the only thing that showed up as a medium risk was the following;

They suggest disabling the use of SSL2 if possible, but I am not sure where to look.
The box uses SSL for secure transactions, but I am not familiar with just 'disabling' v2 and allowing 3, is this an apache change somewhere, a simple conf file change, etc.

I did find an idea googling, and in an included httpd-ssl.conf file found;
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

It can't be something as simple as changing that v2 to v3 is it?

Thanks for any replies.

According to http://www.debianadmin.com/how-to-en...che-hosts.html, yes, that is all that is needed. Although, you may want to copy their SSLCipherSuite and SSLProtocol lines.

Oh, and you then have to do the complicated task of restarting Apache .

HTH

Forrest

Perfect link, thanks. Just try searching for some of those leads to a few different way's, not testing, etc. but that worked perfect and the fact it had the test made it exactly what was needed.

Thanks.
Lr