@michmoor said in Disable weak SSL Cipher:
John shows that those weak ciphers aren’t present on the latest OS
No they are.. I just didn't notice them as being cbc until I set my tool to report in iana names. But to be honest its really a minor concern if one at all. The only devices that should ever talk to the web gui are admin devices in the first place. Proper security would allow only an admin network or admin IP to talk to the gui..
I would never even think to expose my web gui to the public internet in the first place.. So scanning from an external tool like ssl labs should never even be viable to do.
Which is why I scanned using a local tool to report what ciphers are being offered. While I agree there is little point in even offering old ciphers.. I have now set mine to only use tls 1.3 currently. I would never need or want to access from my admin machine with old tls 1.2 etc.. But to be honest its pretty pointless, other than just good practice.
If you were setup securely - accessing the gui via just http shouldn't be a problem..
Once you exposed the gui to public or some other hostile local network - the use of some old cipher via old tls 1.2 should be the least of your concerns.
All that being said, I do agree that it would be a good feature add to allow for tweaking and setting what you want to offer specifically be it via the normal web gui, or some captive portal your running on pfsense. Normal users would prob never have need to adjust, but it would be nice feature.. Maybe let the user select modern ciphers, more compatible ciphers for older browsers, etc. Or full custom settings where user could pick exactly which ciphers are offered.
This sort of granular control should also be available for ssh as well. When I looked earlier redmine was down, when it comes back I might look to see if these features have been requested already, if not maybe I will put them in. Of very low priority request - but it would be nice to have.
