<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">I’m trying to figure out how to make my Cyrus install to not be susceptible to the drown issue.<div class="">I have tried limiting the ciphers to TLSv1.2 but haven’t had much success.</div><div class=""><br class=""></div><div class=""><div class="">What should the tld_ciper_list be? Or is this an issue with SSL? (To fix this do I need to patch the SSL libraries and rebuild SSL and Cyrus?</div><div class=""><div class="">From the imapd.conf file</div><div class="">tls_cipher_list: TLSv1.2:!NULL:!aNULL:!eNULL:!EXPORT:!SSLv2<br class=""></div></div><div class=""><br class=""></div><div class="">Thank you!</div></div><div class=""><br class=""></div><div class="">Other info:</div><div class="">nmap tells me I should be just fine:</div><div class="">nmap --script ssl-enum-ciphers -p T:993 127.0.0.1</div><div class="">PORT STATE SERVICE<br class="">993/tcp open imaps<br class="">| ssl-enum-ciphers: <br class="">| TLSv1.2: <br class="">| ciphers: <br class="">| TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 1024) - A<br class="">| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 1024) - A<br class="">| TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 1024) - A<br class="">| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 1024) - A<br class="">| TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A<br class="">| TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A<br class="">| TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A<br class="">| TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A<br class="">| compressors: <br class="">| NULL<br class="">| cipher preference: client<br class="">| warnings: <br class="">| Key exchange parameters of lower strength than certificate key<br class="">|_ least strength: A<br class=""><br class=""></div><div class="">But the python scanner from <a href="https://drownattack.com/" class="">https://drownattack.com/</a> says I still have an issue.</div><div class=""><br class=""></div><div class="">My version info:</div><div class="">name : Cyrus IMAPD<br class="">version : v2.4.17-Fedora-RPM-2.4.17-8.el7_1 d1df8aff 2012-12-01<br class="">vendor : Project Cyrus<br class="">support-url: <a href="http://www.cyrusimap.org" class="">http://www.cyrusimap.org</a><br class="">os : Linux<br class="">os-version : 3.10.0-327.10.1.el7.x86_64<br class="">environment: Built w/Cyrus SASL 2.1.26<br class=""> Running w/Cyrus SASL 2.1.26<br class=""> Built w/Berkeley DB 5.3.21: (May 11, 2012)<br class=""> Running w/Berkeley DB 5.3.21: (May 11, 2012)<br class=""> Built w/OpenSSL 1.0.1e-fips 11 Feb 2013<br class=""> Running w/OpenSSL 1.0.1e-fips 11 Feb 2013<br class=""> Built w/zlib 1.2.7<br class=""> Running w/zlib 1.2.7<br class=""> CMU Sieve 2.4<br class=""> TCP Wrappers<br class=""> NET-SNMP<br class=""> mmap = shared<br class=""> lock = fcntl<br class=""> nonblock = fcntl<br class=""> idle = idled</div></body></html>