Description of problem:

As a part of BZ1577594 we have started to enable ciphers with key length higher than 128 bits (see [1]) by using "ssl_ciphers=HIGH" in engine <-> VDSM communication for hosts in 4.2 clusters and above. Unfortunately this setting still allowed anonymous ciphers, which are not considered safe, so security sweep raised that as an issue:


  # nmap -sV --script ssl-enum-ciphers -p 54321 <HOSTNAME>
  | ssl-enum-ciphers: 
  |   TLSv1.2: 
  |     ciphers: 
  |       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A
  |       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A
  |       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
  |       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A
  |       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A
  |       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
  |       TLS_ECDH_anon_WITH_AES_128_CBC_SHA - F
  |       TLS_ECDH_anon_WITH_AES_256_CBC_SHA - F
  |       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
  |       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
  |       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
  |       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
  |       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
  |       TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
  |       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (rsa 2048) - A
  |       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (rsa 2048) - A
  |     compressors: 
  |       NULL
  |     cipher preference: client
  |_  least strength: F


In order to raise ciphers strength we need to disable those anonymous ciphers by setting "ssl_ciphers=HIGH:!aNULL", which allows safest ciphers:

# nmap -sV --script ssl-enum-ciphers -p 54321 <HOSTNAME>
| ssl-enum-ciphers: 
|   TLSv1.2: 
|     ciphers: 
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
|       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (rsa 2048) - A
|     compressors: 
|       NULL
|     cipher preference: client
|_  least strength: A


[1] https://www.openssl.org/docs/manmaster/man1/ciphers.html#CIPHER_LIST_FORMAT