2

I have started security scanning my network and have issues with Ubuntu 16 and weak cipher suites. I think I found the sshd config. but everything I read on the TLS for apache tells me to go to /etc/httpd which I do not have the directory. I see openssl ciphers but I can seem to figure out how to disable unwanted ciphers. Can someone point me in the right direction?

Brill
  • 45

2 Answers2

2

openssh does not use TLS so ignore anything that talks about TLS. You will need to modify /etc/ssh/sshd_config. This link may be somewhat dated but is interesting reading. My sshd_config has these lines for the MACs and ciphers

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
MACs hmac-sha1,umac-64@openssh.com,hmac-ripemd160

For web ciphers, edit /etc/apache2/sites-available/ssl.conf. I use

SSLProtocol all -SSLv3 -SSLv2 -TLSv1
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4"
SSLHonorCipherOrder on
doneal24
  • 900
1

I do not have enough reputation to comment, so I have to set a new answer

doneal24 made a small errata on the answer above, it is not

/etc/apache2/sites-available/ssl.conf

but rather

/etc/apache2/mods-available/ssl.conf

the file to modify.

Cheers!

jmcollantes
  • 11