On 9/5/2011 10:50 AM, Michael B Allen wrote: > On Fri, Sep 2, 2011 at 10:19 PM, Noel Jones <[email protected]> wrote: >> On 9/2/2011 2:17 PM, Michael B Allen wrote: >>> My objectives are not driven by or based on logic. They are based on >>> the requirements of a consortium of credit card companies and banks. >> >> Do they require you to offer STARTTLS on port 25? > > My understanding is that PCI compliance requires only that the machine > processing cardholder data pass a vulnerability scan with no CVE > vulnerabilities of level 4 or higher. So the presence of SSLv2 in > general is considered a vulnerability. PCI says nothing of what can be > running on a machine or what ports they use.
So the obvious solution is to disable opportunistic STARTTLS on port 25 until your next upgrade. Or separate your mail and https servers to different IP addresses so it's "not the same server". -- Noel Jones
