Mark RauterkusTips

PCI Report

2024-06-29 · Status: private · Development, Housekeeping, ISCA, Pair, Software

Latest scan, July 1:

threat on PHPThreat TLC

Sam from Pair was corrected when posted in the Help ticket:

F9C3L7S

I assume Clover was performing a PCI compliance scan, and some aspects of the server configuration failed? If they sent you a document or PDF that shows the results of the scan and what precisely failed, please forward it to us and we can help you make the necessary configuration changes so that it passes subsequent scans.

Possible to do list:

  1. Shut down all FTP services at the server.  DONE!
  2. What's up with the SSH and deprecated cyptographic settings? Threat: The SSH protocol (Secure Shell) is a method for secure remote login from one computer to another. The target is using deprecated SSH cryptographic settings to communicate. IMPACT: A man-in-the-middle attacker may be able to exploit this vulnerability to record the communication to decrypt the session key and even the messages. SOLUTION: Avoid using deprecated cryptographic settings. Use best practices when configuring SSH. Refer to Security of Interactive and Automated Access Management Using Secure Shell (SSH) Settings currently considered deprecated. 
  3. Upgrade for MySQLMySQL version 5.7 is detected on the host.MySQL version 5.7 is detected on the host. Product Support for MySQL 5.7 ended in 31 October 2023. No further bug fixes, enhancements, security updates or technical support will be available for this release.
  4. Mailserver stuff for email skipped for now. 
  5. Threat: Database installation on the target. Databases like Oracle, MS-SQL, MySQL, IBM DB2, PostGgresql, Firebird and other are detected. The database instance is listed in the result section below.IMPACT: Information disclosing database type will lead attacker to perform more targeted attacks. SOLUTION: Users are recommended to encrypt the database information and handle the situations where any error is leading to disclose some sensitive information like database type and its version. RESULT: MYSQL server instance detectedMYSQL instance detected on TCP port 3306
  6. Threat: The service aborted the scanning of the Web server before completion, ...Amen. I'm not sure what to do about that. Seem ideal to me.

Older, prior scan fails:

Notes:

THREAT: 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N 3.3 E:U/RL:W/RC:UR 3 48169 Information gathering--2024-06-03 18:20:26.0 

A remote management service that accepts unencrypted credentials was detected on the target host. Services like FTP with basic auth are checked.

Perhaps we need to turn off FTP? I'm fine with that. 

THREAT: 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N 3.3 E:U/RL:W/RC:UR 3 48169

Information gathering--2024-06-03 18:20:26.0 A remote management service that accepts unencrypted credentials was detected on the target host. Services like FTP with basic auth are checked.

Web server presents a directory listing.

IMPACT: All file names in this directory are exposed.

SOLUTION: The presence of a browseable directory does not necessarily imply a vulnerability. Determine if the directory listing is intended to be displayed. Verify that no files in the directory contain content that should not be served by the Web application.

RESULT: url: https://rauterkus.com/wp-content/cache/min/1/wp-content/uploads/

comment: This directory was discovered during the crawl phase. matched: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"> <html> <head> <title>Index of /wp-content/cache/min/1/wp-content/uploads</title> </head> <body> <h1>Index of /wp-content/cache/min/1/wp-content/uploads</h1> <pre><img src="/icons/blank.gif" alt="Icon "> <a href="?C=N;O=D">Name</a> <a href="?C=M;O=A">Last modified</a> <a href="?C=S;O=A">Size</a> <a href="?C=D; O=A">Description</a><hr><img src="/icons/back.gif" alt="[PARENTDIR]"> <a href="/wp-content/cache/min/1/w url: https://rauterkus.com/wp-content/themes/thrive-theme/thrive-dashboard/ comment: This directory was discovered during the crawl phase. matched: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"> <html> <head> <title>Index of /wp-content/themes/thrive-theme/thrive-dashboard</title> </head> <body> <h1>Index of /wp-content/themes/thrive-theme/thrive-dashboard</h1> <pre><img src="/icons/blank.gif" alt="Icon "> <a href="?C=N;O=D">Name</a> <a href="?C=M;O=A">Last modified</a> <a href="?C=S;O=A">Size</a> <a href="?C=D; O=A">Description</a><hr><img src="/icons/back.gif" alt="[PARENTDIR]"> <a href="/wp-content/t url: https://rauterkus.com/wp-content/plugins/thrive-visual-editor/editor/js/dist/ comment: This directory was discovered during the crawl phase

I think I should change the .htaccesss file in both Rauterkus.com and the SwimISCA.org to include:
Options -Indexes

Source: helpdesk.WordPress.2026-06-05.xml · Original ID: 4307