pci compliance help

[EWD]

Hi Guys.

For PCI compliance I need to disable TRACK and TRACE.
I used to be able to to do this by adding the following to httpd.conf

RewriteEngine On 
RewriteCond %{REQUEST_METHOD} ^TRACE 
RewriteRule .* - [F] 
RewriteCond %{REQUEST_METHOD} ^TRACK
RewriteRule .* - [F]

Since EA3 this no longer works. I have tried it in the main httpd.conf as well as the includes and no luck.
Anyone have been able to get these disabled lately?

Thanks in advance for any help.

 

[rpmws]

Hi Guys.

For PCI compliance I need to disable TRACK and TRACE.
I used to be able to to do this by adding the following to httpd.conf

RewriteEngine On 
RewriteCond %{REQUEST_METHOD} ^TRACE 
RewriteRule .* - [F] 
RewriteCond %{REQUEST_METHOD} ^TRACK
RewriteRule .* - [F]

Since EA3 this no longer works. I have tried it in the main httpd.conf as well as the includes and no luck.
Anyone have been able to get these disabled lately?

Thanks in advance for any help.

how about in a .htaccess file in the root of one of the sites? just for the hell of it??

 

[EWD]

Hi,

Yes, that would help for one site. We need it to be server-wide.

I have found that the code above does not work for trace anymore for whatever reason.
Instead you need to add TraceEnable Off to httpd.conf

So what I did was edit /usr/local/apache/conf/includes/pre_main_global.conf and added:

<Directory "/">
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACK
RewriteRule .* - [F]
</Directory>

Also added TraceEnable Off to httpd.conf and that seems to have done the trick.

Thanks for the help and I hope this info helps someone else looking for the same.

 

[robb3369]

mod_security

This can also be addressed via mod_security (installed via Easy Apache) with the default configuration:

# allowed request methods
SecRule REQUEST_METHOD "!^(?:GET|POST|OPTIONS|HEAD)$" \
    "phase:1,log,auditlog,msg:'Method is not allowed by policy', severity:'2',id:'960032'"

 

[MaraBlue]

how about in a .htaccess file in the root of one of the sites? just for the hell of it??

They (the PCI Compliance scanners) will ding you for having an .htaccess.