brew

Install cyrus-sasl with Homebrew, apk, dnf, Nix, pacman, zypper

Simple Authentication and Security Layer. Version 2.1.28 via Homebrew; verified from local package data.

Install command Security notes

install

Additional install commands

macOS

Homebrewverified · 100%

brew install cyrus-sasl

local Homebrew formula metadata

Linux

Alpine Linux apkverified · 92%

sudo apk add cyrus-sasl

Alpine Linux edge package indexes · cyrus-sasl · source: dl-cdn.alpinelinux.org

Fedora dnfverified · 92%

sudo dnf install cyrus-sasl

Fedora Rawhide package metadata · cyrus-sasl · source: dl.fedoraproject.org

Nixverified · 92%

nix profile install nixpkgs#cyrus_sasl

nixpkgs package indexes · pkgs/by-name/cy/cyrus_sasl/package.nix · source: api.github.com

Arch Linux pacmanverified · 92%

sudo pacman -S cyrus-sasl

Arch Linux sync databases · cyrus-sasl · source: geo.mirror.pkgbuild.com

openSUSE zypperverified · 92%

sudo zypper install cyrus-sasl

openSUSE Tumbleweed package metadata · cyrus-sasl · source: download.opensuse.org

overview

Package summary

Simple Authentication and Security Layer

Project links

Commands and aliases

pluginviewer
saslauthd
sasldblistusers2
saslpasswd2
testsaslauthd

history

Project history and usage

Cyrus SASL is the Cyrus project's C implementation of the Simple Authentication and Security Layer API. It lets client and server applications plug in authentication mechanisms such as PLAIN, SCRAM, GSSAPI, OTP, EXTERNAL, and others without each application implementing every mechanism itself.

Project history

The official documentation ties Cyrus SASL to the Carnegie Mellon Cyrus project, originally an enterprise mail-system effort interested in scalable, administrable systems. Cyrus SASL split out the authentication layer as a reusable library for both client and server writers.

The modern documentation describes Cyrus SASL as an implementation of the SASL specification, with Cyrus IMAP as one major consumer but not the only one. The package includes the library, authentication daemons and utilities, mechanism plugins, and sysadmin/developer documentation.

The documentation still carries upgrade material for SASLv1 to SASLv2 applications, which reflects the library's long service life across older mail and network-service deployments.

Adoption history

Cyrus SASL became infrastructure rather than an end-user app: mail servers, LDAP stacks, Kerberos/GSSAPI deployments, and other network services could depend on a common SASL implementation. The official feature list shows plugins for local databases, PAM, SQL, LDAP, Active Directory, Kerberos, proxied IMAP auth, and multiple SASL mechanisms.

Package managers keep Cyrus SASL available because many other packages need headers, libraries, plugins, or command-line utilities such as saslauthd and saslpasswd2. It is the sort of package that appears quietly in dependency trees and becomes visible when authentication fails.

How it is used

Administrators use Cyrus SASL by installing the library and desired plugins, selecting mechanisms, configuring application-specific SASL options, and optionally running saslauthd. Application developers link against libsasl and use callbacks or configuration files to let SASL perform authentication and authorization services.

The installation guide documents application configuration through the application's own config callback or through per-application SASL configuration files such as /usr/lib/sasl/Appname.conf.

Why package nerds care

Cyrus SASL is package-nerd-significant because it is glue code for authentication. It is not flashy, but it explains why mail, LDAP, and Kerberos-capable server packages often drag in sasl libraries, mechanism plugins, and helper daemons.

Timeline

1990s: Cyrus project at Carnegie Mellon builds scalable mail-system infrastructure.
2006: RFC 4422 defines the modern SASL framework referenced by Cyrus SASL documentation.
2016: cyrusimap/cyrus-sasl repository appears on GitHub.
2022: Cyrus SASL 2.1.28 documented as the latest stable version on the official site.

Related projects

Cyrus IMAP uses Cyrus SASL for mail-server authentication support.
Kerberos, LDAP, PAM, SQL databases, and SASL mechanism RFCs are common integration points.
OpenLDAP and other network services are frequent downstream users of SASL libraries.

Sources

security posture

Risk level: green

narrow executable package without higher-risk signals.

Risk classifier

green risk · low confidence · appliance

Why

narrow executable package without higher-risk signals

Signals

metadata:no-higher-risk-signals

Install behavior

No Homebrew post-install hook is recorded in formula metadata.
Homebrew bottle metadata is available for 12 platform targets.
Installs with 2 runtime dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix: /usr/lib/sasl2/<application>.conf/etc/sasl2/<application>.conf

executables

Installed executables

Command	Kind	Exposure
`pluginviewer`	cli	global executable
`saslauthd`	cli	global executable
`sasldblistusers2`	cli	global executable
`saslpasswd2`	cli	global executable
`testsaslauthd`	cli	global executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08

manager version2.1.28

manager updated

local dataok

upstreamnot checked

latest detectednot detected

https://github.com/cyrusimap/cyrus-sasl

infoNo package-manager update timestamp was available.low confidence
infoNo cached GitHub release or tag data was available.https://github.com/cyrusimap/cyrus-saslnone confidence

install metadata

Package metadata

Package key	brew:cyrus-sasl
Version	2.1.28
Package manager	Homebrew
Package manager page	https://formulae.brew.sh/formula/cyrus-sasl
Homepage	https://www.cyrusimap.org/sasl/
Repository	https://github.com/cyrusimap/cyrus-sasl
Upstream docs	https://www.cyrusimap.org/sasl
License	BSD-3-Clause-Attribution
Source archive	https://github.com/cyrusimap/cyrus-sasl/releases/download/cyrus-sasl-2.1.28/cyrus-sasl-2.1.28.tar.gz
Dependencies	krb5, openssl@3
Uses from macOS	libxcrypt
Bottle	available (on arm64_big_sur, arm64_linux, arm64_monterey, arm64_sequoia, arm64_sonoma, arm64_tahoe, arm64_ventura, big_sur, monterey, sonoma, ventura, x86_64_linux)
Homebrew post-install	not defined
Service	none declared

registry facts

Source database details

Source Database	Homebrew formula API
Tap	homebrew/core
Full Name	cyrus-sasl
Version Scheme	0
Revision	2
Bottle Stable Root URL	https://ghcr.io/v2/homebrew/core
Deprecated	no
Disabled	no
Keg Only	yes
URL Keys	stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Nix95%

cyrus_sasl

nix profile install nixpkgs#cyrus_sasl

normalized package name match
Matched by: Cyrus Sasl

nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/cy/cyrus_sasl/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

apk95%

cyrus-sasl 2.1.28-r9

Cyrus Simple Authentication Service Layer (SASL)