The resolution for the POODLE vulnerability says to disable SSLv3 (and SSLv2 if not already) in the /etc/httpd/conf.d/ssl.conf file. I have 3 RHEL servers, all version 5.11, with Apache/2.2.3. The all have the following:
[root@ctc366a httpd]# pwd
/etc/httpd
[root@ctc366a httpd]# ll
total 8
drwxr-xr-x 7 root root 4096 Sep 24 11:52 conf
drwxr-xr-x 2 root root 4096 Oct 15 13:42 conf.d
lrwxrwxrwx 1 root root 19 Sep 24 11:52 logs -> ../../var/log/httpd
lrwxrwxrwx 1 root root 27 Sep 24 11:52 modules -> ../../usr/lib/httpd/modules
lrwxrwxrwx 1 root root 13 Sep 24 11:52 run -> ../../var/run
[root@ctc366a httpd]#

with the httpd.conf file under /etc/httpd/conf, and 2 of them have ssl.conf file under /etc/httpd/conf.d, but the third does not. It does not have ssl.conf file anywhere, and it does not appear to have the SSLProtocol directive in any other file. I don't know why. Can I copy the ssl.conf file from the most similar server and put it onto the server that does not have one, so I can disable the SSLv3?
Thanks!
Julie