GoDaddy Site Scanner issue 1 of 5...

Ok, GoDaddy has given me a list of issues with my Zen Cart installation on my site. Here is what their site scanner is telling me.

Description:

The remote web server contains web pages that are protected by 'Basic' authentication over plain text.

An attacker eavesdropping the traffic might obtain logins and passwords of valid users.

Solution:

To resolve this issue, we suggest that you use an SSL certificate to ensure your authentication is transmitted over a secure connection.
Purchase an SSL certificate GoDaddy Link removed

Output:

The following pages are protected.
/stats:/ realm="***.com Statistics"

I do have a shared SSL cert which came with my hosting plan. I'm not quite sure what they want me to do here. Any suggestions? This is classified as informational only and low risk.

Prior to May 31, 2011, it was informational. Below is the note that I received from my Scanning Vendor.

I'm not qualified to help fix your problem, but I know that the work-around for my site has been to use AuthTLS for my ftp sessions along with the instructions from my host once they disabled the ftp port on my domain.

=======================
On 31 May 2011 the CVSS2 score for FTP Server Clear Text Authentication was raised to 7.5. This is now 'Critical'. Scanning vendors do not rate or rank PCI vulnerabilities. The PCI Council using the industry standard CVSS2 rates and ranks all vulnerabilities as they pertain to PCI.

The reason behind this that it is very easy to intercept and read the clear text FTP Username and Password by sniffing. Having this information, then anyone can upload, modify, delete, or abuse a website, database, etc. Many hosting companies still use FTP for their clients. The PCI Council is downgrading this practice, and mandates more secure channels to be used.

And what you posted has nothing to do with Zen Cart specifically.

Well, not specifically to Zen Cart no, the reason I am posting it here is because the account being scanned is used for my Zen Cart store. So it is talking about my Zen Cart installation. I started here because I figured maybe someone else has run in to the same issue with GoDaddy and their Zen Cart installation, or maybe someone understands what the scanner is trying to tell me.

All I understand is that some information, possibly user names and passwords of customers logging in and out or me logging in and out of the admin section, are being transmitted in plain text and might be able to be read by someone looking for them. I have the SSL Cert, maybe there is something more I need to do with it, dunno though, that's why I am here :D

A LOT more information is needed. You've posted a very generic bit of text saying that there's "a problem".
To figure out what really is wrong, specifics of the exact issue they're talking about are needed.

The problem being reported by GoDaddy appears to be that you don't have an SSL certificate and they'd like to sell you one.

And I think most people here would agree that an SSL certificate is a necessary expense for doing any form of e-commerce, even if it's unclear that this is actually related to the specific problem that goDaddy have identified.

So this is everything it gives me in the details section of the scanner,

The Link says this:

The remote web server seems to transmit credentials in clear text.

The Details:

Port:
http (80/tcp)

Informational

Status:
Not yet addressed

Synopsis:
The remote web server seems to transmit credentials in clear text.

Description:
The remote web server contains web pages that are protected by 'Basic' authentication over plain text. An attacker eavesdropping the traffic might obtain logins and passwords of valid users.

Risk Factor:
Low / CVSS Base Score : 2.6 (CVSS2#AV : N/AC : H/Au : N/C : P/I : N/A : N)

Solution:
To resolve this issue, we suggest that you use an SSL certificate to ensure your authentication is transmitted over a secure connection.
Learn more about SSL certificates: http://en.wikipedia.org/wiki/Transport_Layer_Security
Purchase an SSL certificate: removed this URL taking you to buy and SSL cert

Output:
The following pages are protected.
/stats:/ realm="mywebsite.com Statistics"

The only thing I changed was my web site address at the end and the link to buy the SSL. Don't know if I needed to keep it hidden or not.

I do have a shared SSL certificate, and have verified through my host that it is installed. When I go to 'https://www...' my site comes up, and I have it set so that all of the links in the configure.php file in the admin section all point to the secure site as well, so when I log in to the back end, it SHOULD be secure.

After reading about enabling SSL through Zen Cart I am not sure about one thing,

Shared Certificate
Change includes/configure.php and admin/includes/configure.php to:

// Define the webserver and path parameters
define('HTTP_SERVER', 'http://www.YOUR_SHOP.com');
define('HTTPS_SERVER', 'https://YOUR_SHOP.YOUR_SECURE_SERVER.net'); <--this one?
define('ENABLE_SSL', 'true');

or:

// Define the webserver and path parameters
define('HTTP_SERVER', 'http://www.YOUR_SHOP.com');
define('HTTPS_SERVER', 'https://YOUR_SECURE_SERVER.net/YOUR_USERNAME');<--or this one?
define('ENABLE_SSL', 'true');

or:

// Define the webserver and path parameters
define('HTTP_SERVER', 'http://www.YOUR_SHOP.com');
define('HTTPS_SERVER', 'https://YOUR_SECURE_SERVER.net/~YOUR_USERNAME');<--or this one?
define('ENABLE_SSL', 'true');

I don't know which to use or where to get that info from. Currently, the section in the includes/configure.php file points to 'https://www.YOUR_SHOP.com'.

Anyhow, that's really all the info I have on the matter. If anyone has suggestions, I am willing to give things a whirl, otherwise, Im not sure what to do about it.

Your hosting company are the experts on their servers. Thus, they're the ones you should contact to understand what exactly the URL is for the shared SSL for your site. We can't magically guess what's most appropriate, since every hosting company does things their own way. The fastest answer to your question will be found by asking your hosting company.

Further, your scan alert seems to be talking about a "Statistics" page. Since Zen Cart doesn't have any such page it suggests that the problem the scanner is referring to is something else, probably a statistics menu/panel that your hosting company provides to you. And, again, that should be directed to them to answer.

In fact, the whole scanner report should be sent to your hosting company for resolution.

Ok DrByte, I'll head over there and see if I can get an answer out of them. Thanks for the input :smile:

Does this makes sense? I talked to the hosting company and they suggested I do a forced redirect using .htaccess. So, in the main folder of the site, there is now a .htaccess file that redirects you from http: to https:. I am assuming this forces all traffic to be done over the secure site which should fix the issue.

Sounds like whoever you talked to is just shooting in the dark.

Yes, doing that sort of redirect will make ALL your traffic happen over https ... but now Google won't index any of it either.

What you need to do:

• get the EXACT specifics of what the ACTUAL vulnerability/failure is. The complete URL is important.
• assuming it's not a link to your ZC store, take that actual URL to your hosting company and get them to fix JUST THAT issue. If whoever you're talking to doesn't sound like they know exactly what the issue is, escalate it to someone who does.