Detections
Analytics

6.10 Ensure Weak SSL/TLS Ciphers Are Disabled

Information

The ssl_ciphers parameter specifies which cipher suites may be used by connections using TLS version 1.2 and earlier. Cipher suites for TLS 1.3 connections cannot be configured in this version of PostgreSQL and are provided by the underlying OpenSSL library.

The SSL/TLS protocols support many cipher suites, including weak and medium-strength algorithms subject to man-in-the-middle attacks and information disclosure; some implementations even support the NULL cipher suite, which provides no cryptographic protection. Only strong (128-bit or greater) AEAD cipher suites using forward-secret ( ECDHE ) key exchange should be negotiated. Forward secrecy ensures that recorded traffic cannot be decrypted even if the server's private key is later compromised. All TLS 1.3 cipher suites provide forward secrecy by design.

Solution

Set the ssl_ciphers parameter to the following value:

postgres=# ALTER SYSTEM SET ssl_ciphers = 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
ALTER SYSTEM
postgres=# SELECT pg_reload_conf();
 pg_reload_conf
----------------
 t
(1 row)

Impact:

Clients that do not support at least one approved cipher suite will be unable to connect and must be verified before this change is applied. An invalid cipher parameter value is rejected at configuration reload but will prevent the server from starting at its next restart; verify the configuration immediately after applying it.

See Also

https://workbench.cisecurity.org/benchmarks/26344

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4

Plugin: PostgreSQLDB

Control ID: ad482a37044b56103ca4ba165af32f36e5ae4e677404bfb4a2eb79261a8528f0