<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 12pt; font-family: Verdana,Geneva,sans-serif'>
<p>Turns out imclient (at least in the latest RHEL7 pkg) is hardcoded to use TLSv1. Since we're building binary RPMs from Source RPMs anyway we modified imclient.c, rebuilt the RPMs, reinstalled the cyrus-imapd-utils package: Here's the patch we used:</p>
<p><span style="font-size: 9pt;"><strong>----------------------------------------------------</strong></span></p>
<p><span style="font-size: 9pt;"><strong>--- imclient.c.orig 2012-12-01 13:57:54.000000000 -0600</strong></span><br /><span style="font-size: 9pt;"><strong>+++ imclient.c 2019-10-03 14:40:11.254566297 -0500</strong></span><br /><span style="font-size: 9pt;"><strong>@@ -1695,7 +1695,7 @@</strong></span><br /><span style="font-size: 9pt;"><strong>return -1;</strong></span><br /><span style="font-size: 9pt;"><strong>}</strong></span></p>
<p><span style="font-size: 9pt;"><strong>- imclient->tls_ctx = SSL_CTX_new(TLSv1_client_method());</strong></span><br /><span style="font-size: 9pt;"><strong>+ imclient->tls_ctx = SSL_CTX_new(TLSv1_2_client_method());</strong></span><br /><span style="font-size: 9pt;"><strong>if (imclient->tls_ctx == NULL) {</strong></span><br /><span style="font-size: 9pt;"><strong>return -1;</strong></span><br /><span style="font-size: 9pt;"><strong>};</strong></span></p>
<p>-------------------------------------------</p>
<p>Maybe this helps someone else.</p>
<p>Regards,</p>
<div> </div>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0"><!-- html ignored -->
<p><br /></p>
<!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<p>Hi All,</p>
<p>We're hoping to find some help on the list...</p>
<p>We are running Cyrus-IMAP on RHEL7, using an RPM pkg (<strong>cyrus-imapd-2.4.17-13.el7</strong>) built from the Red Hat SRC RPM. We also have SASL, Utils, devel etc pkgs all from RH.</p>
<p>Now we're looking to finally move Cyrus completely off insecure TLS versions. But now there is a lingering issue...</p>
<p>We removed tls1_0 from impad.conf, and the CYRADM shell stopped working. We can no longer connect at all:</p>
<p><span style="font-size: 9pt;"><strong>cyradm -u cyrus <server></strong></span><br /><span style="font-size: 9pt;"><strong>[ SSL_connect error -1 ]</strong></span><br /><span style="font-size: 9pt;"><strong>[ SSL session removed ]</strong></span><br /><span style="font-size: 9pt;"><strong>[ TLS negotiation did not succeed ]</strong></span><br /><span style="font-size: 9pt;"><strong>cyradm: cannot authenticate to server with as cyrus</strong></span></p>
<p><span style="font-size: 9pt;"><strong>cyradm -u cyrus --notls <server></strong></span><br /><span style="font-size: 9pt;"><strong>[ SSL_connect error -1 ]</strong></span><br /><span style="font-size: 9pt;"><strong>[ SSL session removed ]</strong></span><br /><span style="font-size: 9pt;"><strong>[ TLS negotiation did not succeed ]</strong></span><br /><span style="font-size: 9pt;"><strong>cyradm: cannot authenticate to server with as cyrus</strong></span></p>
<p>The presumption is (as cyradm is just a wrapper script) any PERL scripts calling Cyrus::IMAP::Admin over a STARTTLS connection could likewise be broken (?) if we block TLS 1.0. </p>
<p>cyradm is using TLSv1 per maillog:</p>
<p><span style="font-size: 9pt;"><strong>imaps[14096]: starttls: TLSv1 with cipher <snip></strong></span></p>
<p>Our MAN page for cyradm shows a "--notls" option, which does not work/changes nothing. Oddly, the cyradm <strong>help flag</strong> does NOT show this option, yet cyradm doesn't bark when it's passed:</p>
<p><span style="font-size: 9pt;"><strong>Usage: cyradm [args] server</strong></span><br /><span style="font-size: 9pt;"><strong> --user <user> Connect as <user> (authentication name)</strong></span><br /><span style="font-size: 9pt;"><strong> --authz <user> Authorize as <user></strong></span><br /><span style="font-size: 9pt;"><strong> --[no]rc (Do not) load the configuration files</strong></span><br /><span style="font-size: 9pt;"><strong> --systemrc <file> Use system-wide configuration <file></strong></span><br /><span style="font-size: 9pt;"><strong> --userrc <file> Use user configuration <file></strong></span><br /><span style="font-size: 9pt;"><strong> --port <port> Connect to server on <port></strong></span><br /><span style="font-size: 9pt;"><strong> --auth <mechanism> Authenticate with <mechanism></strong></span></p>
<p>A web search reveals the MAN page for cyradm in Cyrus v.3, and it shows <strong>notls</strong> as an option to AUTHENTICATE, after a server connection is made, so its unclear to me what's going on... </p>
<div>Does anyone have cyradm working with TLS1.2?</div>
<div> </div>
<div>Regards & THANKS in advance for any assistance or suggestions offered.</div>
<div> </div>
<div>-- <br />
<div class="pre" style="margin: 0; padding: 0; font-family: monospace;">John</div>
</div>
<!-- html ignored --><br />
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">----<br /> Cyrus Home Page: <a href="http://www.cyrusimap.org/" target="_blank" rel="noopener noreferrer">http://www.cyrusimap.org/</a><br /> List Archives/Info: <a href="http://lists.andrew.cmu.edu/pipermail/info-cyrus/" target="_blank" rel="noopener noreferrer">http://lists.andrew.cmu.edu/pipermail/info-cyrus/</a><br /> To Unsubscribe:<br /> <a href="https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus" target="_blank" rel="noopener noreferrer">https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus</a></div>
</blockquote>
</body></html>