Update default CIPHERS to a more current list

The default CIPHERS allowed for a fair amount of not really considered
secure anymore connections.  This updated cipher list is taken from
mozilla: https://wiki.mozilla.org/Security/Server_Side_TLS

Signed-off-by: Rhonda D'Vine <rhonda@proxmox.com>

diff --git a/PVE/Service/pveproxy.pm b/PVE/Service/pveproxy.pm
index bb60b29e95cdfeae96811b2dedb4cc55f553a5c7..b286931beb3e8faab672f6c477c86bb7b5c14fe7 100755 (executable)
--- a/PVE/Service/pveproxy.pm
+++ b/PVE/Service/pveproxy.pm
@@ -106,7 +106,7 @@ sub init {
            method => 'any',
            sslv2 => 0,
            sslv3 => 0,
-           cipher_list => $proxyconf->{CIPHERS} || 'HIGH:MEDIUM:!aNULL:!MD5',
+           cipher_list => $proxyconf->{CIPHERS} || 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256',
            key_file => '/etc/pve/local/pve-ssl.key',
            cert_file => '/etc/pve/local/pve-ssl.pem',
        },