How to identify and remove CBC ciphers in the CipherSuite?

1
votes

I have apache http server with below ciphers in the cipherSuite. After a scan I found some of the ciphers(CBC) are weak and need to be removed. But I am unable to identify which of them are actually CBC. Can you please help?

FYI - Versions are

Apache 2.4.23; openssl 1.0.2h; RHEL7

SSLCipherSuite:

ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384: ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256: ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256: ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384: ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256: DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256: DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384: AES128-SHA256:AES256-SHA256:AES:DES-CBC3-SHA: !aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA: !EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!3DES

CBC ciphers causing vulnerability: How to identify these in above suite? * TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 2048) - A TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A*

I found some ciphers with "CBC3", but when I remove them Apache is not responding for https requests.

1
encryptionopensslrsatls1.2cbc-mode
DES-CBC3-SHA is TLS_RSA_WITH_3DES_EDE_CBC_SHA. – zaph
Ok. But When I remove "DES-CBC3-SHA" apache is not responding for any https requests. Where am I going wrong? – Fred
I see there's a cipher "AES" between AES256-SHA256 and DES-CBC3-SHA is this correct or part of the problem? (btw I have almost no experience in this area.) – SteveC

1 Answers

4
votes

Any cipher with CBC in the name is a CBC cipher and can be removed. For improved security, you should also sort the ciphers from strongest to weakest and set SSLHonorCipherOrder on and SSLProtocol all -SSLv3 in your config.

Mozilla has a neat tool for generating secure webserver configurations that you might find useful, notably the modern cipher suite configuration for your Apache and OpenSSL version. After that, try the Qualsys SSL Labs Test to see how you did.