PCI

Disable TLSv1

--------------------

Apache, Exim, Mail and FTP

All -SSLv2 -SSLv3 -TLSv1

Weak or Medium Strength Cipher Suites Supported and SSL 64-bit Block Size Cipher Suites Supported (SWEET32)

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

For SSL Weak or Medium Strength Cipher Suites Supported and SSL 64-bit Block Size Cipher Suites Supported (SWEET32) we need to disable 3DES algorithm in the configuration file using !3DES(some sample ones can be seen in hybrid19,SSD166sql etc).

ssh -Q kex

https://www.ssh.com/ssh/sshd_config/

https://access.redhat.com/discussions/2143791

https://security.stackexchange.com/questions/29262/disabling-authentication-via-dsa-keys-in-openssh

>> CVE-2015-5600

root@uniform [~]# rpm -q --changelog openssh | grep CVE-2015-5600

- CVE-2015-5600: MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices

>> OpenSSH user enumeration based on SHA256 / SHA512 vs Blowfish hashing time difference, CVE-2016-6210

root@uniform [~]# rpm -q --changelog openssh | grep CVE-2016-6210

- Fix for CVE-2016-6210: User enumeration via covert timing channel (#1357442)

>> OpenSSH X11 Security Bypass Vulnerability (OpenSSH 7.2 Release), CVE-2016-1908

root@uniform [~]# rpm -q --changelog openssh | grep CVE-2016-1908

- CVE-2016-1908: Prevent possible fallback from untrusted X11 forwarding (#1299048)

>> OpenSSH Portable (non-OpenBSD) Remote Code Execution and Privilege Escalation by use-after-free bug in pre-auth process, CVE-2015-6564

root@uniform [~]# rpm -q --changelog openssh | grep CVE-2015-6564

- CVE-2015-6564: Use-after-free bug related to PAM support

>> OpenSSH SSHFP DNS resource record look up bypass in the client, CVE-2014-2653

root@uniform [~]# rpm -q --changelog openssh | grep CVE-2014-2653

- prevent a server from skipping SSHFP lookup (#1081338) CVE-2014-2653

>> OpenSSH Wildcards on AcceptEnv VVulnerability , CVE-2014-2532

root@uniform [~]# rpm -q --changelog openssh | grep CVE-2014-2532

- ignore environment variables with embedded '=' or '\0' characters CVE-2014-2532

>> X11 forwarding data allows multiple CRLF injection in OpenSSH before 7.2p2, CVE-2016-3115

root@uniform [~]# rpm -q --changelog openssh | grep CVE-2016-3115

- CVE-2016-3115: missing sanitisation of input for X11 forwarding (#1317817)

>> OpenSSH through 7.2p2 allows potential privilege escalation by remote attackers, CVE-2015-8325

root@uniform [~]# rpm -q --changelog openssh | grep CVE-2015-8325

- CVE-2015-8325: privilege escalation via user's PAM environment and UseLogin=yes (1405374)

>> OpenSSH before 6.9, when ForwardX11Trusted mode is not used lacks proper access

root@uniform [~]# rpm -q --changelog openssh | grep CVE-2015-5352

- CVE-2015-5352: XSECURITY restrictions bypass under certain conditions

Further I can confirm that upgrade is right now not available for Openssh. The server is on the latest supported OpenSSH version. We will upgrade once we have the upgrade available.

>> Local privilege escalation in OpenSSH before 7.4 when sshd runs with root privileges (related to serverloop.c), CVE-2016-10010

This vulnerability does not affect the version OpenSSH as shipped with Red Hat Enterprise Linux 6. Please confirm it from the link https://access.redhat.com/security/cve/cve-2016-10010

root@uniform [~]# cat /etc/redhat-release

CentOS release 6.8 (Final)

>> Remote Access Service Detected

Your domain is right now hosted in a shared environment and hence the SSH access to the server cannot be restricted. This is required for bussiness and cannot set up restirction.

This is the SSH port of the server. As it's a shared hosting environment, we're unfortunately, not able to IP restrict this one. If you process card payments on your website, this shouldn't be on a shared hosting server. You should be on a dedicated box of your own, where you can restrict the IP addresses from which SSH (port 2223) is accessed. If you don't process card details on your website, you can let the PCI agency know this, and they should provide you with an exclusion for the same.

>> OpenSSH sshd User Enumeration Vulnerability, CVE-2018-15473

As mentioned earlier, your site is in SSH access to the server cannot be restricted. This vulnerability is mostly explained in the case of public_key authentication method.

>> OpenSSH allows for the transmission of the entire buffer to remote servers before 7.1p2, CVE-2016-0777

This issue does not affect the version OpenSSH as shipped with Red Hat Enterprise Linux 4, 5 and 6. Please check the link https://access.redhat.com/security/cve/cve-2016-0777

root@uniform [~]# cat /etc/redhat-release

CentOS release 6.8 (Final)