cyrus 22 on Freebsd permission denied

[RYAN vAN GINNEKEN]

Hello i use freebsd 4.11 stable, have been using BINC IMAP and 
cyrus-sasl-2.1.20_1 and cyrus-sasl-saslauthd-2.1.20_1 for imap and 
postfix Authentication. BINC IMAP is a great little program but does not 
have the support for virtual users that i need or the robustness of 
cyrus.  

Recently I been trying to get cyrus-imapd-2.2.12_1 with berkly 
db43-4.3.28 on my freebsd box have followed the instructions to the 
letter but when tried to run mkimap for the cyrus su it did not work so 
just ran it from the regular su account that seemed to work fine.

I login as cyrus su then run the command cyradm localhost  and then my 
password everything seems to work fine on the command line.
However watching the auth.log i see this when i enter cyradm localhost
Aug 15 18:24:14 tokyo imap[89348]: OTP unavailable because can't 
read/write key database /etc/opiekeys: Permission denied

Then this when i enter a password
Aug 15 18:25:03 tokyo imap[89348]: no user in db

next i try to create a user like this createmailbox user.smith and get 
createmailbox:permission denied all the time please help what am i doing 
wrong?

Have added the following to my /etc/syslog.conf but have an empty 
imapd.log the auth.log stuff seems to work ok.

local6.debug                                    /var/log/imapd.log

here are a list or permissions for my directories

inside /var
drwxr-x---  10 cyrus   cyrus     512 Aug 15 18:09 imap

inside /var/imap
-rw-------  1 cyrus  cyrus    144 Aug 12 00:09 annotations.db
drwxr-xr-x  2 cyrus  cyrus    512 Aug 12 00:09 db
drwx------  2 cyrus  cyrus    512 Aug 15 18:09 db.backup1
drwx------  2 cyrus  cyrus    512 Aug 15 17:39 db.backup2
-rw-------  1 cyrus  cyrus  32768 Aug 12 04:00 deliver.db
drwxr-xr-x  2 cyrus  cyrus    512 Aug 12 00:02 log
-rw-------  1 cyrus  cyrus    144 Aug 15 18:29 mailboxes.db
drwxr-xr-x  2 cyrus  cyrus    512 Aug 12 00:02 msg
drwxr-xr-x  2 cyrus  cyrus    512 Aug 15 18:30 proc
drwxr-xr-x  2 cyrus  cyrus    512 Aug 12 00:02 ptclient
drwxr-xr-x  2 cyrus  cyrus    512 Aug 12 00:36 socket
-rw-------  1 cyrus  cyrus  32768 Aug 12 04:00 tls_sessions.db

inside /var/spool
drwxr-x---   3 cyrus  cyrus   512 Aug 12 00:02 imap

inside /var/spool/imap
drwxr-xr-x  2 cyrus  cyrus  512 Aug 12 00:02 stage.

here are the contents of my imap.conf

configdirectory: /var/imap
partition-default: /var/spool/imap
admins: rmvg
sasl_pwcheck_method: saslauthd