I just finished a long conference call with my PCI compliant provider and VISA.
After testing on several servers I found some weakness in the current SSLCipherSuite in both webmin and usermin plus normal SSL sites.
The following information came from testing at https://www.ssllabs.com/ssldb/ and info from http://blog.ivanristic.com/2011/10/mitigating-the-beast-attack-on-tls.html
The Cipher’s that both my PCI provider and I came up with that will be the best security for any SSL attacks is…
For apache these lines are now required by my PCI provider and other providers will be contacted to update their requirements in a few days.
Both Webmin and Usermin must be updated to use those Cipher’s in that order to maintain PCI compliance.
I will be updating my PCI docs to include the new settings that will be required.
If anyone has questions you can contact me directly via email (sgrayban[at]gmail.com) or via phone +1.509.279.0285
Using this for SSLCipherSuite worked for me with OpenSSL version 0.9.8 but didn’t work with 0.9.7 to mitigate the BEAST.
openssl ciphers -v 'ECDHE-RSA-AES256-SHA384:AES256-SHA256:AES256-SHA256:RC4:HIGH:!MD5:!SSLv2:!ADH:!aNULL:!eNULL:!NULL:!DH:!ADH:!EDH:!AESGCM'
Between OpenSSL version the cipher suites will be same except for the following:
EXP1024-RC4-SHA SSLv3 Kx=RSA(1024) Au=RSA Enc=RC4(56) Mac=SHA1 export
where 0.9.8 doesn’t
and 0.9.8 has:
AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1
where 0.9.7 doesn’t.
Not 100% sure it’s the OpenSSL version creating the difference. My two servers are running CentOS 4.x and 5.x. So, they’re generally similar but not identical.
I had exactly the same questions @hudibu!
I found this list is now installed by Virtualmin when installed on Debian, but those two entries make little sense to me. What am I missing?
To prevent the beast and poodle attacks in webmin/usermin the following cypher list is now required…
https://www.borgnet.net/cypher.txt <-- this will give you exactly what you need to add or change to your miniserv.conf files