<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 12pt; font-family: Verdana,Geneva,sans-serif'>
<p>Hi All,</p>
<p>We're hoping to find some help on the list...</p>
<p>We are running Cyrus-IMAP on RHEL7, using an RPM pkg (<strong>cyrus-imapd-2.4.17-13.el7</strong>) built from the Red Hat SRC RPM. We also have SASL, Utils, devel etc pkgs all from RH.</p>
<p>Now we're looking to finally move Cyrus completely off insecure TLS versions. But now there is a lingering issue...</p>
<p>We removed tls1_0 from impad.conf, and the CYRADM shell stopped working. We can no longer connect at all:</p>
<p><span style="font-size: 9pt;"><strong>cyradm -u cyrus <server></strong></span><br /><span style="font-size: 9pt;"><strong>[ SSL_connect error -1 ]</strong></span><br /><span style="font-size: 9pt;"><strong>[ SSL session removed ]</strong></span><br /><span style="font-size: 9pt;"><strong>[ TLS negotiation did not succeed ]</strong></span><br /><span style="font-size: 9pt;"><strong>cyradm: cannot authenticate to server with as cyrus</strong></span></p>
<p><span style="font-size: 9pt;"><strong>cyradm -u cyrus --notls <server></strong></span><br /><span style="font-size: 9pt;"><strong>[ SSL_connect error -1 ]</strong></span><br /><span style="font-size: 9pt;"><strong>[ SSL session removed ]</strong></span><br /><span style="font-size: 9pt;"><strong>[ TLS negotiation did not succeed ]</strong></span><br /><span style="font-size: 9pt;"><strong>cyradm: cannot authenticate to server with as cyrus</strong></span></p>
<p>The presumption is (as cyradm is just a wrapper script) any PERL scripts calling Cyrus::IMAP::Admin over a STARTTLS connection could likewise be broken (?) if we block TLS 1.0. </p>
<p>cyradm is using TLSv1 per maillog:</p>
<p><span style="font-size: 9pt;"><strong>imaps[14096]: starttls: TLSv1 with cipher <snip></strong></span></p>
<p>Our MAN page for cyradm shows a "--notls" option, which does not work/changes nothing. Oddly, the cyradm <strong>help flag</strong> does NOT show this option, yet cyradm doesn't bark when it's passed:</p>
<p><span style="font-size: 9pt;"><strong>Usage: cyradm [args] server</strong></span><br /><span style="font-size: 9pt;"><strong> --user <user> Connect as <user> (authentication name)</strong></span><br /><span style="font-size: 9pt;"><strong> --authz <user> Authorize as <user></strong></span><br /><span style="font-size: 9pt;"><strong> --[no]rc (Do not) load the configuration files</strong></span><br /><span style="font-size: 9pt;"><strong> --systemrc <file> Use system-wide configuration <file></strong></span><br /><span style="font-size: 9pt;"><strong> --userrc <file> Use user configuration <file></strong></span><br /><span style="font-size: 9pt;"><strong> --port <port> Connect to server on <port></strong></span><br /><span style="font-size: 9pt;"><strong> --auth <mechanism> Authenticate with <mechanism></strong></span></p>
<p>A web search reveals the MAN page for cyradm in Cyrus v.3, and it shows <strong>notls</strong> as an option to AUTHENTICATE, after a server connection is made, so its unclear to me what's going on... </p>
<div>Does anyone have cyradm working with TLS1.2?</div>
<div> </div>
<div>Regards & THANKS in advance for any assistance or suggestions offered.</div>
<div> </div>
<div>-- <br />
<div class="pre" style="margin: 0; padding: 0; font-family: monospace;">John</div>
</div>
</body></html>