Disable weak ciphers for TLS servers

You can disable weak ciphers for TLS servers.

To disable ciphers, append :!<cipher_name> to both cipher_list and server_cipher_list in the /etc/cloudera-scm-agent/config.ini file.

The default values of those cipher configurations in the config.ini file are:

cipher_list=HIGH:!DSS:!DH:!ADH:!DES:!3DES:!SHA1:!aNULL:!eNULL:!EXPORT:!SSLv2:!SSLv3:!TLSv1

server_cipher_list=HIGH:!DSS:!DH:!ADH:!DES:!3DES:!SHA1:!aNULL:!eNULL:!EXPORT:!SSLv2:!SSLv3:!TLSv1:!CAMELLIA

Append the following to each of the values for cipher_list and server_cipher_list:

:!ECDHE-RSA-AES256-SHA384:!ECDHE-RSA-AES128-SHA256:!AES256-CCM8:!AES256-CCM:!AES128-CCM8:!AES128-CCM:!AES256-SHA256:!AES128-SHA256