Linode NodeBalancer Fails PCI DSS Compliance Scan by Trustwave
So we finally set up a NodeBalancer to terminate SSL for our web nodes and pointed a PCI scan from Trustwave.
We passed all their vectors except for one that we have no control over!
The scan shows that the TLS v1.0 protocol is supported by the NodeBalancer.
Has anyone here overcome this?
The only choice we have is to remove the nodebalancer and terminate SSL at the host level. This would mean that the awesome autoscaling code that we have been writing to bring nodes up and down behind the nodebalancer will be completely wasted.
We need a central load balancer to do the SSL stuff so that nodes can be added/removed as needed.
Of course, we can build our own load balancer using squid or nginx but the key benefit of a cloud provider is the ready-made tools and API. So I am very disappointed to face this issue.
Anyone else faced this issue?
4 Replies
Anyway, it would be really good to be able to control the NodeBalancer's SSL configuration (protocol version, ciphersuite, OCSP stapling, etc). Some of us have more stringent security requirements, whereas others may have to support a wider range of outdated devices and browsers. Since about a year ago, it is no longer possible for a single SSL configuration to satisfy both needs.
So for the time being, we filed a Risk Mitigation and Migration Plan with TrustWave as a stop-gap measure. It turns out that PCI DSS itself recommends doing so until 2016.
Thank you for taking them time to offer solutions. We are still very excited about Linode and the community is just awesome!
Anyway, here is what I have done to pass PCI scan by Trustwave:
Since I was failing only for the TLS v1 issue and there is no way to get rid of it without taking over SSL at the node level, I went with Trustwave's advice and filed a Risk Mitigation Plan, which they accepted upon review.