1

I have an IMAP server running on Fedora (cyrus-imapd-2.4.18-1.fc23.i686) with the following configuration:

$ cat /etc/imapd.conf
configdirectory: /var/lib/imap
partition-default: /var/spool/imap
admins: cyrus
sievedir: /var/lib/imap/sieve
sendmail: /usr/sbin/sendmail
hashimapspool: true
sasl_pwcheck_method: saslauthd
sasl_mech_list: PLAIN

userdeny_db: flat

tls_cert_file: /etc/pki/tls/certs/corti.li.crt
tls_key_file: /etc/pki/tls/private/corti.li.key
# Chain
tls_ca_file: /etc/pki/tls/certs/COMODORSA.crt

#tls_cipher_list: HIGH
#tls_cipher_list: TLSv1:SSLv3:!SSLv2:!NULL:!EXPORT:!DES:!LOW:@STRENGTH:!ADH
tls_cipher_list: TLSv1+HIGH:!aNULL:@STRENGTH:!MEDIUM

# uncomment this if you're operating in a DSCP environment (RFC-4594)
# qosmarking: af13

and everything works perfectly. I am now migrating to CentOS 7 (cyrus-imapd-2.4.17-8.el7_1.x86_64) but with the same configuration the server still accepts connections with SSLv2 and low grade cyphers.

$ ./testssl.sh --color 0 new.corti.li:993 
[...]
 further IP addresses:   2a01:4f8:c17:3bac::2
 rDNS (138.201.94.195):  static.195.94.201.138.clients.your-server.de.
 Service detected:       IMAP, thus skipping HTTP specific checks

 Testing protocols (via sockets except TLS 1.2, SPDY+HTTP2) 

 SSLv2      not offered (OK)
 SSLv3      offered (NOT ok)
 TLS 1      offered
 TLS 1.1    offered
 TLS 1.2    offered (OK)
 SPDY/NPN   not offered
 HTTP2/ALPN not offered

 Testing ~standard cipher lists 

 Null Ciphers                 not offered (OK)
 Anonymous NULL Ciphers       not offered (OK)
 Anonymous DH Ciphers         not offered (OK)
 40 Bit encryption            not offered (OK)
 56 Bit encryption            not offered (OK)
 Export Ciphers (general)     not offered (OK)
 Low (<=64 Bit)               not offered (OK)
 DES Ciphers                  not offered (OK)
 Medium grade encryption      not offered (OK)
 Triple DES Ciphers           offered
 High grade encryption        offered (OK)

I do not see any error in the logs. Any idea why

    tls_cipher_list: TLSv1+HIGH:!aNULL:@STRENGTH:!MEDIUM

is ignored?

Edit

The same settings on the Fedora machine produce (no SSLv3):

$ ./testssl.sh --color 0 corti.li:993 
[...]
 further IP addresses:   2a01:4f8:d13:f44::2
 rDNS (78.47.122.114):   corti.li.
 Service detected:       IMAP, thus skipping HTTP specific checks

 Testing protocols (via sockets except TLS 1.2, SPDY+HTTP2) 

 SSLv2      not offered (OK)
 SSLv3      not offered (OK)
 TLS 1      offered
 TLS 1.1    offered
 TLS 1.2    offered (OK)
 SPDY/NPN   not offered
 HTTP2/ALPN not offered

 Testing ~standard cipher lists 

 Null Ciphers                 not offered (OK)
 Anonymous NULL Ciphers       not offered (OK)
 Anonymous DH Ciphers         not offered (OK)
 40 Bit encryption            not offered (OK)
 56 Bit encryption            not offered (OK)
 Export Ciphers (general)     not offered (OK)
 Low (<=64 Bit)               not offered (OK)
 DES Ciphers                  not offered (OK)
 Medium grade encryption      not offered (OK)
 Triple DES Ciphers           offered
 High grade encryption        offered (OK)
  • Based on the information you show it is neither accepting SSLv2 nor weak ciphers. the only bad thing is supporting the SSLv3 protocol. But cyrus has no settings for restricting the protocol version and you cannot set this using the ciphers because if you disable SSLv3 ciphers you effectively disable all ciphers needed to support TLS 1.0 and TLS 1.1 too. – Steffen Ullrich Jun 28 '16 at 20:48
  • @SteffenUllrich But it is working on Fedora. I'll update the question – Matteo Jun 29 '16 at 7:14
  • 1
    Fedora might have ported security fixes back. Newer versions of imapd have SSLv3 disabled by default. And it looks like there is actually a way to configure the supported protocol with tls_versions, see access.redhat.com/articles/1470873 – Steffen Ullrich Jun 29 '16 at 8:27
  • @SteffenUllrich Thanks works perfectly. Please post it as an answer so that I can accept it – Matteo Jun 29 '16 at 8:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.