Ubuntu 16.04 – How to Disable Weak SSL Ciphers

ciphersslubuntu-16.04

I have started security scanning my network and have issues with Ubuntu 16 and weak cipher suites. I think I found the sshd config. but everything I read on the TLS for apache tells me to go to /etc/httpd which I do not have the directory. I see openssl ciphers but I can seem to figure out how to disable unwanted ciphers. Can someone point me in the right direction?

Best Answer

openssh does not use TLS so ignore anything that talks about TLS. You will need to modify /etc/ssh/sshd_config. This link may be somewhat dated but is interesting reading. My sshd_config has these lines for the MACs and ciphers

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
MACs hmac-sha1,umac-64@openssh.com,hmac-ripemd160

For web ciphers, edit /etc/apache2/sites-available/ssl.conf. I use

SSLProtocol all -SSLv3 -SSLv2 -TLSv1
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4"
SSLHonorCipherOrder on

Related Solutions

SSLCipherSuite – Disable Weak Encryption, CBC Cipher, and MD5 Algorithm

If their only complaint is MD5-based MAC, you should be able to simply add the !MD5 element to your existing cipher suite to meet the recommendation.

That said, I see they complain about the use of the CBC mode as well. Unfortunately, there is no CBC cipher group. The recommendation given to you also does not exclude CBC mode cipherspecs, at least on my version of openSSL (1.0.1e). This is a shame. If you need all such ciphers to be excluded, you could exclude all the CBC ones explicitly, though you will have to update that as they are included. Note that even HIGH includes CBC ciphers.

Including both ALL and RC4+RSA is redundant. I would be loathe to trust a security consultant (even a computerized one) that cannot even construct a well-formed cipherspec that meets their own recommendations.

The SSLCipherSuite takes an OpenSSL cipher spec. You can find this in the openssl documentation (link), but I find that this documentation is usually quite out of date. However, you can test one by running openssl ciphers ${cipherspec} on your server; output will be a :-separated list of ciphers that would be allowed by the given spec, or an error indicating none were allowed.

Similarly, if you want to know what LOW contains, do:

falcon@tiernyn ~ $ openssl ciphers 'LOW'
EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:ADH-DES-CBC-SHA:DES-CBC-SHA:DES-CBC-MD5

!LOW means to exclude those ones. +HIGH means to prefer the high-security ones in the ordering.

If you want a line-delimited list of all the ciphers that use CBC in your cipherspec, do:

openssl ciphers ${cipherspec} | sed 's/:/\n/g' | grep CBC

Those are the ones you'd have to exclude. You may, however, find it more reasonable to grep -v CBC and include only those (just set them up in a :-delimited list and use that as the cipherspec).

Ssl – Server has “weak cipher setting” according to security audit, replaced offending cipher TLS_RSA_WITH_3DES_EDE_CBC_SHA, but still failing retest audit

the new cipher suite string you installed still has 3DES ciphers in it. Get rid of anything in the list with the word DES.

Best Answer

Related Solutions

SSLCipherSuite – Disable Weak Encryption, CBC Cipher, and MD5 Algorithm

Ssl – Server has “weak cipher setting” according to security audit, replaced offending cipher TLS_RSA_WITH_3DES_EDE_CBC_SHA, but still failing retest audit

Related Topic