# Disable specific weak cipher for port 5665

**URL:** <https://community.icinga.com/t/disable-specific-weak-cipher-for-port-5665/12578>\
**Category:** Icinga 2\
**Tags:** tls, icinga2\
**Created:** [September 11, 2023, 12:43pm UTC](https://community.icinga.com/t/disable-specific-weak-cipher-for-port-5665/12578 "2023-09-11T12:43:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![xion824](https://community.icinga.com/letter_avatar_proxy/v4/letter/x/dbc845/32.png) [@xion824](https://community.icinga.com/u/xion824)\
**Post date:** [September 11, 2023, 12:43pm UTC](https://community.icinga.com/t/disable-specific-weak-cipher-for-port-5665/12578/1 "2023-09-11T12:43:54Z")

</div>

Hey, everyone. Recent Nessus scanning against our Icinga2 host are showing a weak cipher on 5665. Thus far, we have been unable to get the system to disable this cipher. Was hoping the hive mind could help out here.

OS: RHEL 8.8  
Icinga ver. 2.9.5  
PHP ver. 7.2.24  
Weak cipher: ECDHE-RSA-AES128-SHA256

We currently have /etc/icinga2/features-enabled/api.conf configured with the following:

cipher\_list = “TLS13\_AES\_256\_GCM\_SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES256-GCM-SHA384”

Any help with disabling the weak cipher listed above would be greatly appreciated. TIA

---

<div class="post-metadata">

**Author:** ![moreamazingnick](https://community.icinga.com/user_avatar/community.icinga.com/moreamazingnick/32/7725_2.png) [@moreamazingnick](https://community.icinga.com/u/moreamazingnick)\
**Post date:** [September 11, 2023, 5:07pm UTC](https://community.icinga.com/t/disable-specific-weak-cipher-for-port-5665/12578/2 "2023-09-11T17:07:49Z")

</div>

1. the result on the nessus scan would be helpful.
2. you need to add this to the agents as well.
3. don’t forget to restart icinga2.
4. you icinga version is super old

---

<div class="post-metadata">

**Author:** ![Al2Klimov](https://community.icinga.com/user_avatar/community.icinga.com/al2klimov/32/959_2.png) [@Al2Klimov](https://community.icinga.com/u/Al2Klimov)\
**Post date:** [September 11, 2023, 5:07pm UTC](https://community.icinga.com/t/disable-specific-weak-cipher-for-port-5665/12578/3 "2023-09-11T17:07:50Z")

</div>

Hello @xion824!

> [@xion824](#):
>
> Icinga ver. 2.9.5

At best upgrade straight to 2.14, we’ve hardened the defaults recently.

Best,  
A/K

---

<div class="post-metadata">

**Author:** ![xion824](https://community.icinga.com/letter_avatar_proxy/v4/letter/x/dbc845/32.png) [@xion824](https://community.icinga.com/u/xion824)\
**Post date:** [September 12, 2023, 12:10pm UTC](https://community.icinga.com/t/disable-specific-weak-cipher-for-port-5665/12578/4 "2023-09-12T12:10:41Z")

</div>

I was able to disable the cipher by adding it to the cipher\_list line with “-” in front of it. For some reason this didn’t register previously, but this time it did.

---

<div class="post-metadata">

**Author:** ![xion824](https://community.icinga.com/letter_avatar_proxy/v4/letter/x/dbc845/32.png) [@xion824](https://community.icinga.com/u/xion824)\
**Post date:** [September 12, 2023, 12:12pm UTC](https://community.icinga.com/t/disable-specific-weak-cipher-for-port-5665/12578/5 "2023-09-12T12:12:02Z")

</div>

Unable to do so due to developer specific requirements.