Disallow cleartext on the wire

[jonr at destar.net]

Hello List!

I am going mad, mad as in crazy.

CentOS 5.5

Sendmail 8.13.8/8.13.8

cyrus-imapd.x86_64        -2.3.7-7.el5_4.3
cyrus-imapd-devel.x86_64  -2.3.7-7.el5_4.3
cyrus-imapd-perl.x86_64   -2.3.7-7.el5_4.3
cyrus-imapd-utils.x86_64  -2.3.7-7.el5_4.3

cyrus-sasl.x86_64         -2.1.22-5.el5_4.3
cyrus-sasl-devel.x86_64   -2.1.22-5.el5_4.3

cyrus-sasl-gssapi.x86_64  -2.1.22-5.el5_4.3
cyrus-sasl-lib.x86_64     -2.1.22-5.el5_4.3
cyrus-sasl-md5.x86_64     -2.1.22-5.el5_4.3
cyrus-sasl-plain.x86_64   -2.1.22-5.el5_4.3


I am using Thunderbird to test with. I want completely disallow logins  
without TLS for IMAP.

This is my /etc/imapd.conf

configdirectory: /var/lib/imap
partition-default: /var/spool/imap
admins: cyrus
sievedir: /var/lib/imap/sieve
sendmail: /usr/sbin/sendmail
hashimapspool: true
sasl_pwcheck_method: saslauthd auxprop


sasl_mech_list: LOGIN PLAIN
allowplainwithouttls: 0
allowanonymouslogins: 0
virtdomains: userid
tls_cert_file: /etc/pki/cyrus-imapd/cyrus-imapd.pem
tls_key_file: /etc/pki/cyrus-imapd/cyrus-imapd.pem
tls_ca_file: /etc/pki/tls/certs/ca-bundle.crt


I think maybe I am confused here. I thought 'allowplainwithouttls: O'  
would not allow cleartext passwords but now I am thinking it means  
only the PLAIN mech.

Is that correct?

If that is the case, how do I configure the server to only accept  
PLAIN LOGIN only if there is SSL/TLS present? Right now when I do a  
packet capture on the session I can see the username and password in  
cleartext inside of my capture file.

Thanks for any help,

Jon