InspIRCd-2.0.23 r0 - How to disable old ciphers

[GabrieleMax]

I have an old version of InspIRCd (2.0.23 r0), in the future plans obviously it'll be an update action asap but now I should disable weak ciphers like:
DHE-RSA-AES256-GCM-SHA384
DHE-RSA-CHACHA20-POLY1305
DHE-RSA-CAMELLIA256-GCM-SHA384
DHE-RSA-AES256-CCM

I tried in the config file the option priority="PFS" but it doesn't disable weak ciphers, after it I tried something like priority="PFS:!DHE-RSA-AES256-GCM-SHA384:!DHE-RSA-CHACHA20-POLY1305:!DHE-RSA-CAMELLIA256-GCM-SHA384:!DHE-RSA-AES256-CCM" but InspIRCd's log said it doesn't work and it switches to priority="NORMAL".

Is there a way to manage\disable weak ciphers?

[SadieCat]

How to configure a GnuTLS priority string is documented here:

https://gnutls.org/manual/html_node/Priority-Strings.html#Using-Priority-Strings

You can get a list of cipher suites with gnutls-cli --list.

[GabrieleMax]

Thanks SadieCat for your reply! :)

I already knew the list of GnuTLS strings, I also tried SECURE256 but when I check the ciphers by:

openssl s_client -connect <server_ip>:6667 -cipher DHE-RSA-AES256-GCM-SHA384

the result is "connected" so I need to know if in the InspIRCd's config file I could use\add a tag like ciphers= where I can exclude particular ciphers.

[SadieCat]

You can disable ciphers using a priority string. They are documented on the GnuTLS docs page I linked as well as on the page linked from that.

GnuTLS does not use the same names as OpenSSL. You need to use the the GnuTLS names if you are using the ssl_gnutls module.

[GabrieleMax]

Thanks SadieCat for your reply, I updated my irc server to the latest version 4.4.0, there are enabled TLS v1.3 and v1.2, I'd like to use just TLS v1.3 and I'd like to set the max values of security (now I have priority="SECURE256").

Obviously I'm reading Inspircd's doc and I hope to find what I'd like to do but if you know something about it you can feel free to write it! Thanks! :)

[SadieCat]

You probably want a priority string like SECURE192:-VERS-TLS-ALL:+VERS-TLS1.3.