From 0d93b15a63db50ed2ac1a6074a4928d81d9409cf Mon Sep 17 00:00:00 2001
From: Masaya-A <68965261+Masaya-A@users.noreply.github.com>
Date: Fri, 15 Jan 2021 11:47:04 +0900
Subject: [PATCH] Disable weak cipher suites from influxdb

The default config of influxdb enables use of some weak cipher suites such as RC4 and 3DES(SWEET32).
To disable them, a list of enabled ciphers added into influxdb.conf.
---
 salt/influxdb/etc/influxdb.conf | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/salt/influxdb/etc/influxdb.conf b/salt/influxdb/etc/influxdb.conf
index 32f78ff40..86c1ccfe8 100644
--- a/salt/influxdb/etc/influxdb.conf
+++ b/salt/influxdb/etc/influxdb.conf
@@ -550,6 +550,25 @@
   #   "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
   #   "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
   # ]
+  ciphers = [
+      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
+      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
+      "TLS_RSA_WITH_AES_128_CBC_SHA",
+      "TLS_RSA_WITH_AES_128_CBC_SHA256",
+      "TLS_RSA_WITH_AES_128_GCM_SHA256",
+      "TLS_RSA_WITH_AES_256_CBC_SHA",
+      "TLS_RSA_WITH_AES_256_GCM_SHA384",
+  ]
 
   # Minimum version of the tls protocol that will be negotiated. If not specified, uses the
   # default settings from Go's crypto/tls package.