I have started security scanning my network and have issues with Ubuntu 16 and weak cipher suites. I think I found the sshd config. but everything I read on the TLS for apache tells me to go to /etc/httpd which I do not have the directory. I see openssl ciphers but I can seem to figure out how to disable unwanted ciphers. Can someone point me in the right direction?
Asked
Active
Viewed 7,641 times
2 Answers
2
openssh does not use TLS so ignore anything that talks about TLS. You will need to modify /etc/ssh/sshd_config. This link may be somewhat dated but is interesting reading. My sshd_config has these lines for the MACs and ciphers
Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
MACs hmac-sha1,umac-64@openssh.com,hmac-ripemd160
For web ciphers, edit /etc/apache2/sites-available/ssl.conf. I use
SSLProtocol all -SSLv3 -SSLv2 -TLSv1
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4"
SSLHonorCipherOrder on
doneal24
- 561
- 4
- 10
-
But what about the web ciphers? – Brill Feb 01 '19 at 14:59
-
@Brill My answer has been edited to reflect web configuration. – doneal24 Feb 01 '19 at 15:11
0
I do not have enough reputation to comment, so I have to set a new answer
doneal24 made a small errata on the answer above, it is not
/etc/apache2/sites-available/ssl.conf
but rather
/etc/apache2/mods-available/ssl.conf
the file to modify.
Cheers!
jmcollantes
- 1
- 3
-
-
1@GeraldSchneider didn't know that you could edit the answer -subject to revision- while not being able to comment it! Just done so! – jmcollantes Jan 17 '22 at 17:27
-
Great. I approved your edit, but it will be pending until one or two more people approve it. You will even get some reputation when it goes through. – Gerald Schneider Jan 17 '22 at 17:39
-
@GeraldSchneider Good! Should I delete this answer to reduce noise? – jmcollantes Feb 05 '22 at 07:59