This approach seems to cover ports 8443, 443, 993, 995 and 465 in terms of shutting off the offending SSLv2 protocol. However, it would have been much easier for all if Plesk had incorporated these changes in the regular release cycle, rather than everybody having to tolerate an insecure server or manually make the changes below as I have done.
#--------------------------------------------------
# Make a Plesk server PCI Compliance
#--------------------------------------------------
#
#--------------------------------------------------
# Turn off SSLv2 for port 8443 (Plesk port)
#--------------------------------------------------
# create a file
# /usr/local/psa/admin/conf/httpsd.custom.include
# and insert the following lines:
# SSLProtocol all -SSLv2
# SSLCipherSuite ALL:!ADH:!NULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:-LOW:+SSLv3:+TLSv1:-SSLv2:+EXP:+eNULL
# Once you insert the above lines, restart the ‘psa’ service
# and run the ‘openssl’ command to test:
# service psa stopall
# service psa start all
# openssl s_client -connect localhost:8443 -ssl2
#--------------------------------------------------
# Turn off SSLv2 for Apache SSL port 443
#--------------------------------------------------
# Edit the file:
# /etc/httpd/conf.d/ssl.conf
# and insert the following lines:
# SSLProtocol all -SSLv2
# SSLCipherSuite ALL:!ADH:!NULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:-LOW:+SSLv3:+TLSv1:-SSLv2:+EXP:+eNULL
# Once you insert the lines, restart the ‘httpd’ service and run the ‘openssl’ command to test:
# service httpd restart
# openssl s_client -connect localhost:443 -ssl2
#--------------------------------------------------
# Edit courier-imap(s) to turn off SSLv2 for ports 993(IMAP)/995(POP3)
#--------------------------------------------------
# Edit the following files
# vi /etc/courier-imap/imapd-ssl
# vi /etc/courier-imap/pop3d-ssl
# comment the line which starts with “TLS_CIPHER_LIST†and insert the following line:
# TLS_CIPHER_LIST="ALL:!ADH:RC4+RSA:!SSLv2:!LOW
STRENGTH"
# restart the ‘courier-imap’ service and execute the ‘openssl’ command to test:
# service courier-imap restart
# openssl s_client -connect localhost:993 -ssl2
# openssl s_client -connect localhost:995 -ssl2
#--------------------------------------------------
# To turn off SSLv2 for port 465(SMTPS)
#--------------------------------------------------
# Create the following files:
# vi /var/qmail/control/tlsserverciphers
# vi /var/qmail/control/tlsclientciphers
# and insert the following code:
# ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:!SSLv2:RC4+RSA:+HIGH:+MEDIUM
# Once done, restart the ‘qmail’ service and test the connection on SSLv2:
# service qmail restart
# openssl s_client -connect localhost:465 -ssl2
# This will disable SSLv2 for all the SSL ports of your server.
#--------------------------------------------------
Facebook
Twitter
