EDR: How to Update SSL Ciphers Used for Communication

[#1]

Environment

• EDR Server: All Versions

Objective

Update the ssl ciphers used for communication on the server

Resolution

Important: Cipher Settings need to be on all nodes in a clustered instance. 

1. Determine which Cipher suite you want the EDR server to accept. The default configuration receives an A+ score on ssllabs. 

   Strength	Configuration in /etc/cb/cb.conf	Ciphers Allowed
   Strongest (Default)	UseIncreasedSecurityCiphers = true UseWeakCBCSecurityCiphers = false	TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 2048) TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048)
   Weaker	UseIncreasedSecurityCiphers = true UseWeakCBCSecurityCiphers = true	Additional CBC Ciphers added to the above: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 2048) TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 2048) TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048)
   Weakest	UseIncreasedSecurityCiphers = false UseWeakCBCSecurityCiphers = false	Additional Ciphers to all the above: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048)

2. Enable the wanted configs on each node (clustered). 
3. Restart cb-enterprise services to take affect

If the Ciphers you want enabled are not in the pre-built list, you will need to customize the template. Keep in mind, the endpoints need to have matching Cipher to complete the handshake. 

1. Take a backup of the original template file

   cp /etc/cb/nginx/conf.d/templates/cipher_lists.conf.template /etc/cb/nginx/conf.d/templates/cipher_lists.conf.template.bkp

2. Open to edit /etc/cb/nginx/conf.d/templates/cipher_lists.conf.template, modifying line 2: ssl_ciphers
   • A colon (:) is used to separate each cipher suite
   •  An exclamation mark (!) is used in front of the cipher suites that need to be explicitly exclude
   • Example (please see Nginx documentation for more info):

     ssl_ciphers TLSv1.2+FIPS@STRENGTH:EECDH+AESGCM:EDH+AESGCM;

3. Edit /etc/cb.conf and add the following value anywhere in the file, this will tell the product to use the first ssl_cipher in the template you customized

   UseIncreasedSecurityCiphers = false

4. Restart cb-enterprise services: EDR: How to Restart Server Services

Additional Notes

• Configuration must be applied to ALL nodes of a cluster, not just the primary node.
• Please see Nginx documentation on configuring specific ssl ciphers 
• The endpoints need to have matching Cipher to complete the handshake. EDR: How to Determine Cipher Matching Between Endpoint and Server

Related Content

EDR: How to Determine Cipher Matching Between Endpoint and Server
EDR: Sensor failed to register with HrError [0x80072F8F] after successful installation
EDR Server: Vulnerability Scanner reports medium strength encryption with 3DES cipher available on p...
EDR: Nginx Fails to Start with nginx: [emerg] "ssl_ciphers" directive is duplicate in /etc/cb/nginx/...