The point is passing Credit Card compliance tests. OOB, Ubuntu doesn't do so well. Spent the last two weeks getting through the process. I'll write it up in some detail but the key points were: <ul><li>ciphers</li> <li>protocols</li><li>ip separation</li><li>NameVirtualHosts</li><li>no default directory paths</li><li>modsecurity</li><li>TRACE - took rewrite rules to get rid of it</li><li>server isolation (smtp, pop, imap, dns, ntp)</li> <li>utility isolation (phpmyadmin, phpinfo, cacti, webmin)</li><li>secure ftp</li></ul><div>Now I would like a script to monitor sites and home pages on a daily basis to I can catch PHP issues.</div> On Thu, Aug 5, 2010 at 10:02 AM, Etienne Goyer <<a href="mailto:etienne.goyer@canonical.com">etienne.goyer@canonical.com</a>> wrote: > On 10-08-04 06:05 PM, Kees Cook wrote: >> Hi Jim, >> >> On Wed, Aug 04, 2010 at 09:44:25AM -0400, Jim Tarvid wrote: >>> Why not kill the weak ciphers too? >> >> Sure! Can you send a patch for this? > > I do not really see the point. Since the client and the server will > negotiate the strongest cipher they both support, what exactly would we > gain by removing cipher considered weak? > > > -- > Etienne Goyer > Technical Account Manager - Canonical Ltd > Ubuntu Certified Instructor - LPIC-3 > > ~= Ubuntu: Linux for Human Beings =~ > > -- > ubuntu-devel mailing list > <a href="mailto:ubuntu-devel@lists.ubuntu.com">ubuntu-devel@lists.ubuntu.com</a> > Modify settings or unsubscribe at: <a href="https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel">https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel</a> > -- Rev. Jim Tarvid, PCA Galax, Virginia <a href="http://ls.net">http://ls.net</a> <a href="http://drupal.ls.net">http://drupal.ls.net</a>