Security Scan of my Server running OpenSuse 10.2

Hi,

I did a security scan of my Server and I get these risk:

Synopsis :
The remote service supports the use of weak SSL ciphers.
Description :
The remote host supports the use of SSL ciphers that offer either weak
encryption or no encryption at all.

Solution :
Reconfigure the affected application if possible to avoid use of weak
ciphers.

How do I do this?

  • benjaminkramer,

AFAIK there is no general configuration, it depends on the application. What is it? Apache?
BTW, if security is a concern, you shouldn’t use 10.2 any more. It has reached end of life and will not receive updates.

Uwe

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

What application did you use for your “security scan”? As Uwe asked…
which application was the “violation” again? SUSE doesn’t come with
services opened up to the world by default, though it’s possible you
installed something like Apache/httpd or something which has SSL
enabled. If you did, and if the firewall was down so you could scan it
from a remote host, it may make some additional sense, but in that case
you need to probably first go to a later version of OpenSUSE to get the
latest software, the newest/strongest ciphers, etc. SSH is enabled by
default, but the firewall is up. I could imagine a justified error
since SSH protocol 1 is allowed by default and in my opinion SSH should
ALWAYS be set to only use protocol 2.

Anyway, more details will get us closer.

Good luck.

Uwe Buckesfeld wrote:
> * benjaminkramer,
>
> AFAIK there is no general configuration, it depends on the application. What is it? Apache?
> BTW, if security is a concern, you shouldn’t use 10.2 any more. It has reached end of life and will not receive updates.
>
> Uwe
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFJJwmh3s42bA80+9kRApCNAJ9OgSxkS9u+imOzJYeRV1VhtOxuiQCffWsa
iy6kkdDfCVIV2l7l9H5poLc=
=Oa17
-----END PGP SIGNATURE-----