1

Running this command resulted with the list of ciphers which supports rc4:

/usr/bin/openssl ciphers -v | grep -i "rc4"

What's the easiest way and how to remove specifically ciphers that supports rc4 that I need to execute or where is the configuration file in need to edit on Linux machines?

What's the way to reverse the impact of this command? In case one of the server applications will stop working we will need to revert back to the previous Cipher Suites configuration.

schroeder
  • 123,438
  • 55
  • 284
  • 319
Infidel
  • 71
  • 1
  • 1
  • 4
  • If an application uses the default cipher list of openssl, you can affect that by editing /etc/ssl/openssl.cnf like in this answer (where they lower the security): https://askubuntu.com/a/1233456 – Z.T. Aug 22 '20 at 22:35

1 Answers1

2

Linux is just an operating system and doesn't understand the concept of “cipher suites”. Each application that supports TLS has its own configuration regarding cipher suites.

For example, for Apache, edit the SSLCipherSuite directive in the configuration file (/etc/apache2/httpd.conf, or wherever your distribution puts it, or one of the files that it includes). For Nginx, edit the ssl_ciphers directive in /etc/nginx/nginx.conf (again, the exact location may vary).

Note that major distributions are likely to ship reasonable defaults out of the box. I would not expect RC4 to be enabled by default on a system where security updates have been applied.

Gilles 'SO- stop being evil'
  • 50,912
  • 13
  • 120
  • 179
  • If I'm interested only in SSH hardening at the moment, what would be the location I need to edit? – Infidel Aug 23 '20 at 07:12
  • @Infidel `/etc/sshd_config` or `/etc/ssh/sshd_config`. But it's very unlikely to have unsafe defaults out of the box. OpenSSH stopped supporting RC4 altogether in 2017 and has CBC disabled by default (although distributions might still enable it for backward compatibility). Note that SSH is a different protocol from TLS and does not have the same ciphersuites.. – Gilles 'SO- stop being evil' Aug 23 '20 at 10:39