I'm sure many have been hit with getting rid of CBC SSL ciphers by their Security scans like in Tenable. I had trouble finding much data on the topic out there so here's what I was able to find and the steps I took to fix it the weak cipher

1. NMAP your iDrac to see what SSL ciphers are currently in use with:

nmap -p 443 --script ssl-enum-ciphers IP Address .

Example:

|   TLSv1.2:

|     ciphers:

|       TLS_DHE_RSA_WITH_SEED_CBC_SHA (dh 1024) - A

|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A

|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A

|       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A

|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A

|       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A

|       TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A

|       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (rsa 2048) - A

|       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (rsa 2048) - A

|       TLS_RSA_WITH_SEED_CBC_SHA (rsa 2048) - A

 

You can reference the OpenSSL Page for the short terms.

https://www.openssl.org/docs/man1.0.2/apps/ciphers.html

2. Open your iDrac web GUI and go to iDrac Settings > Network > Services

TLS Protocol: TLS 1.2 Only

Custom Cipher String: ECDHE-RSA-AES256-GCM-SHA384:!aNULL:!AES128-SHA:!AES128-SHA256:AES128-GCM-SHA256:!AES256-SHA:!AES256-SHA256:AES256-GCM-SHA384:!DHE-RSA-AES128-SHA256:!DHE-RSA-AES256-SHA256:!DHE-RSA-AES256-SHA:!DHE-RSA-AES128-SHA:!DHE-RSA-CAMELLIA128-SHA:!DHE-RSA-CAMELLIA256-SHA:!DHE-RSA-SEED-SHA:!CAMELLIA128-SHA:!CAMELLIA256-SHA:!SEED-SHA

It's a long string, but the iDrac requires you to specify the Cipher you DON'T want to use.

3. Click apply and wait.

NMAP Results:

|   TLSv1.2:

|     ciphers:

|       TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 2048) - A

|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A

|       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A

|       TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A