January 2026 - dovecot

Lazy expunge does not work as previously after upgrade from Dovecot 2.3 to 2.4.1
by Peter Milesson 11 Jan '26

11 Jan '26

Hi folks, I upgraded an IMAP server from Dovecot 2.3 to 2.4.1 (Debian 13). I have used the lazy expunge plugin for many years, and after upgrade, it was impossible to get it working as previously. After many trials I got it working sort of, but not as previously. The mail location and driver is the following: mail_home = /data/vmail/%{user | username} mail_driver = sdbox mail_path = ~/dbox Previously I had the following structure ~/dbox (user's mailboxes) ~/expunged (user's expunged emails) After upgrade I had to resort to store expunged messages in the inbox namespace in the hidden folder .EXPUNGED, instead of in a separate structure under ~/expunged. This is something I sincerely dislike, as I want expunged messages separate. Now, when messages are expunged, Dovecot no longer obeys the structure of the mailboxes, and puts all expunged messages in the .EXPUNGED folder. Previously the structure of the ~/expunged folder was a copy of the inbox namespace, but now it is just a large garbage bag. This is really a breaking change, and very unfortunate. I had a retention period of 90 days for expunged messages, mainly as a forensic tool. It has been of great help in correcting users that do not follow company guidelines, and opened insecure/infected archives, even if it's strictly prohibited. It has also rescued whole folder structures with sub folders on several occasions, when the users have inadvertently deleted a main folder, and then emptied trash. Now all expunged messages are stored in one big mess, which is much harder to analyze, and I assume, almost impossible to recover to the original state, if that would be needed. I would like to ask, if it is at all possible to get the equivalent of the previous behavior, and in that case, what the configuration would look like. Any help would be very appreciated. Best regards, Peter

1 0

mail-crypt transition from Dovecot 2.3 to 2.4
by m＠maltris.org 11 Jan '26

11 Jan '26

In Dovecot 2.3 I had used the following query: password_query = \ SELECT USER.user, USER.host, \ SECRET.password, SECRET.public_key AS mail_crypt_global_public_key, SECRET.private_key AS mail_crypt_global_private_key \ FROM USER \ WHERE USER.user = '%Lu' This worked fine, enabling encryption and decryption properly. For Dovecot 2.4 this does not work anymore. Example from LMTP: Dec 11 15:02:59 lmtp(975838): Info: lmtp-server: conn unix:pid=975905,uid=113 [1]: rcpt user(a)test.de: <Ti6aNxPPOmne4w4APAc66w>: Failed to send message to <user(a)test.de> at server:24: 451 4.2.0 <user(a)test.de> get_public_key(INBOX) failed: mailbox_attribute_get(INBOX, /shared/vendor/vendor.dovecot/pvt/crypt/active) failed: Mailbox attributes not enabled (1/1 at 12 ms) I tried to adapt it to Dovecot 2.4 per the documentation, ending up with this: query = \ SELECT \ USER.user, USER.host, \ SECRET.password, \ concat('inline:', SECRET.public_key) AS crypt_global_public_key_file, \ 'main' AS crypt_global_private_key, \ concat('inline:', SECRET.private_key) AS 'crypt_global_private_key/main/crypt_private_key_file' \ FROM USER \ WHERE USER.user = '%{user | lower}' Still the error message: get_public_key(INBOX) failed: mailbox_attribute_get(INBOX, /shared/vendor/vendor.dovecot/pvt/crypt/active) failed: Mailbox attributes not enabled Additionally I tried without the "inline:" prefix, because without, doveadm mailbox cryptokey list would return a "no such file or directory error" trying to treat the key as a filename. With the "inline:" prefix it returns nothing except a warning: Warning: mailbox cryptokey list: Nothing was matched. Use -U or specify mask? What is the right way to proceed here?

2 2

Created DokuWiki entries for the migration from Dovecot 2.3 to 2.4.
by Klaus Tachtler 10 Jan '26

10 Jan '26

Hello everyone, Over the past few weeks, I have migrated from Dovecot 2.3 to 2.4 and documented this in my DokuWiki. I do not claim that this is complete, nor is it an all-encompassing description. It includes a configuration for Dovecot 2.3 and the respective migration to Dovecot 2.4. I implemented the following configurations: Dovecot ArchLinux Dovecot ArchLinux - SSL/TLS Dovecot ArchLinux - SASL Dovecot ArchLinux - Quotas Dovecot ArchLinux - Mail-Log-Schreibung Dovecot ArchLinux - Zlib-Komprimierung Dovecot ArchLinux - SQL Dovecot ArchLinux - SQL - Quota: SQL Dovecot ArchLinux - Sieve (Pigeonhole) Dovecot ArchLinux - Shares Dovecot ArchLinux - Master-User The DokuWiki entries are in German, but I think the code examples speak for themselves, and if necessary, a translation program can also be used. The Dokuwiki and my implementations can be accessed at the following link: https://dokuwiki.tachtler.net/doku.php?id=index#imap-server_dovecot_imap-se… The documentation was created using the Archlinux operating system, but can certainly be ported to other Linux distributions. I hope someone else might find my notes useful too? Best regards, Klaus Tachtler. -- --------------------------------------- e-Mail : klaus(a)tachtler.net Homepage: https://www.tachtler.net DokuWiki: https://dokuwiki.tachtler.net ---------------------------------------

3 3

Problems building from source under Trixie
by William Silverstein 09 Jan '26

09 Jan '26

I am running Debian Trixie. I try building the, but the configuration fails: I tried building with: ./configure \ --prefix=/usr/local/dovecot \ --with-sql \ --with-mysql \ --without-pam \ --without-pgsql \ --without-sqlite \ --with-solr \ --with-bzlib \ --with-lz4 \ --with-ldap I get configure: error: cannot build with MySQL support: Neither MySQL (mysqlclient) nor MariaDB library (libmariadb) found. But I did install libldb-dev. I also installed libldap2-dev liblz4-dev But when I do: EXPAT_CFLAGS=/usr/include EXPAT_LIBS=/lib/x86_64-linux-gnu \ LZ4_CFLAGS=/usr/include LZ4_LIBS=/usr/lib/x86_64-linux-gnu \ ZLIB_CFLAGS=/usr/include ZLIB_LIBS=/lib/x86_64-linux-gnu \ MARIADB_LIBS=/usr/lib/x86_64-linux-gnu MARIADB_CFLAGS=/usr/include/mariadb \ ./configure \ --prefix=/usr/local/dovecot \ --with-sql \ --with-mysql \ --without-pam \ --without-pgsql \ --without-sqlite \ --with-solr \ --with-bzlib \ --with-lz4 It configures, them fails in the build. I got some LZ4_DEPRECATED("use LZ4_compress_default() instead") LZ4LIB_API int LZ4_compress (const char* src, char* dest, int srcSize); I get a bunch of linker errors: /usr/bin/ld: ./.libs/libcompression.a(istream-lz4.o): in function `i_stream_lz4_read': /usr/local/src/dovecot-2.4.2/src/lib-compression/istream-lz4.c:192:(.text+0x619): undefined reference to `LZ4_decompress_safe' /usr/bin/ld: ./.libs/libcompression.a(istream-zlib.o): in function `i_stream_zlib_init': /usr/local/src/dovecot-2.4.2/src/lib-compression/istream-zlib.c:324:(.text+0x1d): undefined reference to `inflateInit2_' /usr/bin/ld: ./.libs/libcompression.a(istream-zlib.o): in function `i_stream_zlib_close': /usr/local/src/dovecot-2.4.2/src/lib-compression/istream-zlib.c:46:(.text+0xa8): undefined reference to `inflateEnd' /usr/bin/ld: ./.libs/libcompression.a(istream-zlib.o): in function `i_stream_zlib_reset': /usr/local/src/dovecot-2.4.2/src/lib-compression/istream-zlib.c:358:(.text+0x168): undefined reference to `inflateEnd' /usr/bin/ld: /usr/local/src/dovecot-2.4.2/src/lib-compression/istream-zlib.c:358:(.text+0x3a7): undefined reference to `inflateEnd' /usr/bin/ld: ./.libs/libcompression.a(istream-zlib.o): in function `i_stream_zlib_read': /usr/local/src/dovecot-2.4.2/src/lib-compression/istream-zlib.c:264:(.text+0x97f): undefined reference to `inflate' /usr/bin/ld: /usr/local/src/dovecot-2.4.2/src/lib-compression/istream-zlib.c:220:(.text+0xa7f): undefined reference to `inflateEnd' /usr/bin/ld: ./.libs/libcompression.a(ostream-lz4.o): in function `o_stream_lz4_compress': /usr/local/src/dovecot-2.4.2/src/lib-compression/ostream-lz4.c:94:(.text+0x12f): undefined reference to `LZ4_compress' /usr/bin/ld: ./.libs/libcompression.a(ostream-zlib.o): in function `o_stream_zlib_close': /usr/local/src/dovecot-2.4.2/src/lib-compression/ostream-zlib.c:91:(.text+0x1ee): undefined reference to `deflateEnd' /usr/bin/ld: ./.libs/libcompression.a(ostream-zlib.o): in function `o_stream_create_zlib': /usr/local/src/dovecot-2.4.2/src/lib-compression/ostream-zlib.c:412:(.text+0x339): undefined reference to `deflateInit2_' /usr/bin/ld: ./.libs/libcompression.a(ostream-zlib.o): in function `o_stream_zlib_send_flush': /usr/local/src/dovecot-2.4.2/src/lib-compression/ostream-zlib.c:281:(.text+0x577): undefined reference to `deflate' /usr/bin/ld: ./.libs/libcompression.a(ostream-zlib.o): in function `o_stream_zlib_send_chunk': /usr/local/src/dovecot-2.4.2/src/lib-compression/ostream-zlib.c:213:(.text+0x83b): undefined reference to `deflate' Any suggestions? Thanks. -- William G. Silverstein, Esq. 8383 Wilshire Blvd. Suite 630. Beverly Hills, CA 90211

2 1

Error: userdb: client doesn't have lookup permissions for this user
by vwoloszczuk＠tutanota.com 09 Jan '26

09 Jan '26

Hi, I am trying to configure Dovecot 2.4.2 to work as MDA for Postfix 3.10.5, using LMTP and SASL, with virtual users. This is Debian 13. I had Postfix working fine before trying to incorporate Dovecot, and I was also able to get LMTP working with system users (no SASL), but now things are not working. I've followed the guides in the documentation for using Dovecot and Postfix, in particular the following page: https://doc.dovecot.org/2.4.2/howto/sasl/postfix.html I've set up my 'service auth {}' to look like in that page. When I send mail to <user>, I get the following logs and the message is deferred by Postfix: lmtp(119643): Connect from local auth(<user>): Error: userdb: client doesn't have lookup permissions for this user: userdb reply doesn't contain uid (to bypass this check, set: service auth { unix_listener /run/dovecot/auth-userdb { mode=0777 } }) lmtp(<user> <mailto:viktor@woloszcz.uk>)<119643><SRJICIBlYGlb0wEAk6KCeQ>: Error: auth-master: userdb lookup(<user>): Auth USER lookup failed lmtp(119643): Error: lmtp-server: conn unix:pid=119900,uid=101 [3]: rcpt <user>: Failed to lookup user <user>: Internal error occurred. Refer to server log for more information. lmtp(119643): Disconnect from local: Logged out (state=READY) I am using passwd-file passdb '/etc/dovecot/passwd' with entries in the form '<user>:{PLAIN}password'. This file is owned by root and is world-readable.I am not using a userdb but have set 'mail_uid = vmail' and 'mail_gid = vmail' The socket is located at '/var/spool/postfix/dovecot/auth' (i.e. visible to Postfix) and is owned by the postfix user.I've tried changing the permissions of the socket as the error message instructed but this didn't have any effect. I haven't set 'user = doveauth' as in this page:https://doc.dovecot.org/2.4.2/howto/virtual/postfix.html I don't understand what that would do. Please find attached my full dovecot.conf in case it is useful. Thanks in advance, Viktor Hi, I am trying to configure Dovecot 2.4.2 to work as MDA for Postfix 3.10.5, using LMTP and SASL, with virtual users. This is Debian 13. I had Postfix working fine before trying to incorporate Dovecot, and I was also able to get LMTP working with system users (no SASL), but now things are not working. I've followed the guides in the documentation for using Dovecot and Postfix, in particular the following page: [1]https://doc.dovecot.org/2.4.2/howto/sasl/postfix.html I've set up my 'service auth {}' to look like in that page. When I send mail to <user>, I get the following logs and the message is deferred by Postfix: lmtp(119643): Connect from local auth(<user>): Error: userdb: client doesn't have lookup permissions for this user: userdb reply doesn't contain uid (to bypass this check, set: service auth { unix_listener /run/dovecot/auth-userdb { mode=0777 } }) lmtp([2]<user>)<119643><SRJICIBlYGlb0wEAk6KCeQ>: Error: auth-master: userdb lookup(<user>): Auth USER lookup failed lmtp(119643): Error: lmtp-server: conn unix:pid=119900,uid=101 [3]: rcpt <user>: Failed to lookup user <user>: Internal error occurred. Refer to server log for more information. lmtp(119643): Disconnect from local: Logged out (state=READY) I am using passwd-file passdb '/etc/dovecot/passwd' with entries in the form '<user>:{PLAIN}password'. This file is owned by root and is world-readable. I am not using a userdb but have set 'mail_uid = vmail' and 'mail_gid = vmail' The socket is located at '/var/spool/postfix/dovecot/auth' (i.e. visible to Postfix) and is owned by the postfix user. I've tried changing the permissions of the socket as the error message instructed but this didn't have any effect. I haven't set 'user = doveauth' as in this page: [3]https://doc.dovecot.org/2.4.2/howto/virtual/postfix.html I don't understand what that would do. Please find attached my full dovecot.conf in case it is useful. Thanks in advance, Viktor References Visible links 1. https://doc.dovecot.org/2.4.2/howto/sasl/postfix.html 2. mailto:viktor@woloszcz.uk 3. https://doc.dovecot.org/2.4.2/howto/virtual/postfix.html

2 3

how to use dovecot-lda with dovecot.crt?
by Matthias Bodenbinder 09 Jan '26

09 Jan '26

Hi, I have a self signed certificate for dovecot: > [root@rakete] /etc/dovecot > # ll > insgesamt 12K > -rwxr-xr-x 1 root root 1,7K 2026-01-09@09:56 dovecot.conf > -rw-r----- 1 root root 1,4K 2026-01-09@09:54 dovecot.crt > -rw-r----- 1 root root 1,7K 2026-01-09@09:54 dovecot.key in dovecot.conf I have: ssl_server { cert_file = /etc/dovecot/dovecot.crt key_file = /etc/dovecot/dovecot.key } This works fine for the evolution email client. But when I want to use dovecot-lda as part of my getmail6 config I get a permission denied: # getmail --rcfile dogado-rc -n -v getmail version 6.19.10 Copyright (C) 1998-2025 Charles Cazabon and others. Licensed under GPL-2.0. SimpleIMAPSSLRetriever:bodenbinder_de_9@imap.dogado.net:993: Delivery error (command dovecot-lda 1510042 error (89, doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 51: cert_file: open(/etc/dovecot/dovecot.crt) failed: Permission denied)) [INBOX] msg 1/1 (1392 bytes), delivery error (command dovecot-lda 1510042 error (89, doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 51: cert_file: open(/etc/dovecot/dovecot.crt) failed: Permission denied)) 1 messages (1392 bytes) retrieved, 0 skipped dogado-rc has this delivery section: [destination] type = MDA_external path = /usr/lib/dovecot/dovecot-lda arguments = ("-d", "matthias") When I change ownership of the certificate files it works: # chown root:matthias /etc/dovecot/dovecot.crt /etc/dovecot/dovecot.key [root@rakete] /etc/dovecot # ll /etc/dovecot/dovecot.crt /etc/dovecot/dovecot.key -rw-r----- 1 root matthias 1,4K 2026-01-09@09:54 /etc/dovecot/dovecot.crt -rw-r----- 1 root matthias 1,7K 2026-01-09@09:54 /etc/dovecot/dovecot.key If I do not change permissions for dovecot.key I get a similar error for that file too. But can this be the solution? That would mean that I need to give read access to the crt/key file to every user who wants to use dovecot-lda. Is that correct? Matthias

2 2

Republish of dovecot 2.4.2 packages
by Aki Tuomi 08 Jan '26

08 Jan '26

Hi! Due to mistake in RHEL 10 packaging, we have republished packages for 2.4.2. Content is still the same, build number has increased by one. The important change is that there is now pigeonhole package for RHEL 10. You can find the packages at https://repo.dovecot.org/ as usual. Kind regards, Aki Tuomi

1 0

File system errors
by Jyrki Partanen 07 Jan '26

07 Jan '26

I am trying to move from one VPS to another and strange (for me) file system errors arose. On the new VPS the IMAP client can see the Inbox, but not any other mailboxes. I get these errors in the log: Jan 5 04:49:14 partanen dovecot[144921]: imap(jyrki)<145495><65K/GptHn8tVnMi0>: Error: open(/home/jyrki/mail/.imap/dovecot.list.index.log) failed: Permission denied (euid=1000(jyrki) egid=1000(jyrki) missing +r perm: /home/jyrki/mail/.imap/dovecot.list.index.log stat(/home/jyrki/mail/.imap/dovecot.list.index.log) failed: Permission denied) Jan 5 04:49:14 partanen dovecot[144921]: imap(jyrki)<145495><65K/GptHn8tVnMi0>: Error: Mailbox INBOX: open(/home/jyrki/mail/.imap/INBOX/dovecot.index.log) failed: Permission denied (euid=1000(jyrki) egid=1000(jyrki) missing +r perm: /home/jyrki/mail/.imap/INBOX/dovecot.index.log stat(/home/jyrki/mail/.imap/INBOX/dovecot.index.log) failed: Permission denied) Jan 5 04:49:14 partanen dovecot[144921]: imap(jyrki)<145495><65K/GptHn8tVnMi0>: Error: Couldn't create mailbox list lock /home/jyrki/mail/.imap/mailboxes.lock: file_create_locked(/home/jyrki/mail/.imap/mailboxes.lock) failed: safe_mkstemp(/home/jyrki/mail/.imap/mailboxes.lock) failed: Permission denied Jan 5 04:49:14 partanen dovecot[144921]: imap(jyrki)<145499><nxbBGptHoMtVnMi0>: Error: Mailbox INBOX: open(/home/jyrki/mail/.imap/INBOX/dovecot.index.log) failed: Permission denied (euid=1000(jyrki) egid=1000(jyrki) missing +r perm: /home/jyrki/mail/.imap/INBOX/dovecot.index.log stat(/home/jyrki/mail/.imap/INBOX/dovecot.index.log) failed: Permission denied) ...etc... The thing is that the permissions should be OK, the files are not "missing +r perm". Any idea how to fix this? Thanks! I am trying to move from one VPS to another and strange (for me) file system errors arose. On the new VPS the IMAP client can see the Inbox, but not any other mailboxes. I get these errors in the log: Jan 5 04:49:14 partanen dovecot[144921]: imap(jyrki)<145495><65K/GptHn8tVnMi0>: Error: open(/home/jyrki/mail/.imap/dovecot.list.index.log) failed: Permission denied (euid=1000(jyrki) egid=1000(jyrki) missing +r perm: /home/jyrki/mail/.imap/dovecot.list.index.log stat(/home/jyrki/mail/.imap/dovecot.list.index.log) failed: Permission denied) Jan 5 04:49:14 partanen dovecot[144921]: imap(jyrki)<145495><65K/GptHn8tVnMi0>: Error: Mailbox INBOX: open(/home/jyrki/mail/.imap/INBOX/dovecot.index.log) failed: Permission denied (euid=1000(jyrki) egid=1000(jyrki) missing +r perm: /home/jyrki/mail/.imap/INBOX/dovecot.index.log stat(/home/jyrki/mail/.imap/INBOX/dovecot.index.log) failed: Permission denied) Jan 5 04:49:14 partanen dovecot[144921]: imap(jyrki)<145495><65K/GptHn8tVnMi0>: Error: Couldn't create mailbox list lock /home/jyrki/mail/.imap/mailboxes.lock: file_create_locked(/home/jyrki/mail/.imap/mailboxes.lock) failed: safe_mkstemp(/home/jyrki/mail/.imap/mailboxes.lock) failed: Permission denied Jan 5 04:49:14 partanen dovecot[144921]: imap(jyrki)<145499><nxbBGptHoMtVnMi0>: Error: Mailbox INBOX: open(/home/jyrki/mail/.imap/INBOX/dovecot.index.log) failed: Permission denied (euid=1000(jyrki) egid=1000(jyrki) missing +r perm: /home/jyrki/mail/.imap/INBOX/dovecot.index.log stat(/home/jyrki/mail/.imap/INBOX/dovecot.index.log) failed: Permission denied) ...etc... The thing is that the permissions should be OK, the files are not "missing +r perm". Any idea how to fix this? Thanks!

4 4

Non Existent User Login Attempts
by Bryan Simmons 06 Jan '26

06 Jan '26

Log contains several messages from dovecot that are not clear to me exactly what is occurring, single example below. These appear to be login attempts for the same group of non existent user ids from various rip addresses. Am I interpreting these correctly and, if so, is there any issue with just ignoring them? dovecot: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 0 secs): user=<non-existent-user(a)example.net>, rip=0.0.0.0 Thank you, Bryan

6 6

How can I use /etc/passwd auth for linux users and a passwd-file for virtual mailbox users?
by Ethan Merrill 06 Jan '26

06 Jan '26

Hello, I hope this is the right mailing list to send questions to. Please direct me where to go if it is not. Thanks. --- I am setting up a postfix/dovecot email server on a Debian 13 VPS. Dovecot is v2.4.1. I have thus far been able to successfully configure the server for smtp and imap support for my primary domain (we'll say `user(a)example.com` who is a linux user with a home folder). I have been even been able to configure postfix to have virtual mailboxes and aliases, and from ssh I can can even see that the mail gets delivered to the correct place. However, I am struggling to set up dovecot to authenticate a virtual mailbox user (we'll say `user(a)example.net` who only has a virtual mailbox). [This documentation page](https://doc.dovecot.org/2.4.2/core/config/auth/mutltiple.html) describes the process to configure multiple authentication databases. It describes being able to use multiple `passdb` and `userdb` sections in order to authenticate dovecot users. Based upon what it suggested, I tried this configuration: > ## Snippet from /etc/dovecot/dovecot.conf ## > passdb passwd-file { > # So example.net => /etc/dovecot/passwd/example.net > passwd_file_path = /etc/dovecot/passwd/%{user | domain} > } > # Fall thru to PAM for unix users > passdb pam { > } > > userdb passwd-file { > passwd_file_path = /etc/dovecot/passwd/%{user | domain} > } > # Fall thru to /etc/passwd for unix users > userdb passwd { > } > > ## Snippet from /etc/dovecot/passwd/example.net ## > support@example.net:$y$j9...hash...:800:800::/var/postfix/virtual/example.net/support:: This is the configuration I landed on that hypothetically checks multiple databases for authentication that allows at least `user(a)example.com` to still login with Thunderbird and do email stuff. However it does not authenticate `user(a)example.net`. The biggest difference between my config and the example is that they use a `sql` database while I am trying the `passwd-file` database. In principle this seems like it should work, unless I am understanding the dovecot docs or have made my passwd file incorrectly. I even tried reversing the order of `userdb` and `passdb` sections to see if it would help to no avail. [This thread](https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thre… seems to address a similar issue, and more or less has the same configuration setup suggested as the one in the snippet above. It's also from 2006 so the API looks kinda different from the current docs. [This thread](https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thre… is from 2013 addressing a similar issue, but despite again different API it translates to more or less what the snippet above shows. Here is the journalctl output from when I tried to login as `user(a)example.net`: > # journalctl -xeu dovecot | tail > Dec 29 11:38:19 example.com auth[4719]: pam_unix(dovecot:auth): check pass; user unknown > Dec 29 11:38:19 example.com auth[4719]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=user(a)example.net rhost=10.0.0.1 > Dec 29 11:38:28 example.com auth[4719]: pam_unix(dovecot:auth): check pass; user unknown > Dec 29 11:38:28 example.com auth[4719]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=user(a)example.net rhost=10.0.0.1 > Dec 29 11:41:19 example.com dovecot[4700]: imap-login: Login aborted: Inactivity (auth failed, 2 attempts in 180 secs) (auth_failed): user=<user(a)example.net>, method=LOGIN, rip=10.0.0.1, lip=10.0.0.2, TLS, session=<z8Tj3hlHkLxJMmuL> The last message referring to "Inactivity" is because at that point fail2ban blocked my IP, but before that it was consistent with results I have been getting. I'm at an absolute loss. I feel like I've trawled every doc I could find, every config file involved in the setup process, all the Stack Exchange answers that seem to exist. Honestly it baffles me to see that even what looks like the same setup as official documentation, it just doesn't... work? Can anybody point to me what is going wrong? Thanks for reading, ~ Ethan Merrill Hello, I hope this is the right mailing list to send questions to. Please direct me where to go if it is not. Thanks. --- I am setting up a postfix/dovecot email server on a Debian 13 VPS. Dovecot is v2.4.1. I have thus far been able to successfully configure the server for smtp and imap support for my primary domain (we'll say `user(a)example.com` who is a linux user with a home folder). I have been even been able to configure postfix to have virtual mailboxes and aliases, and from ssh I can can even see that the mail gets delivered to the correct place. However, I am struggling to set up dovecot to authenticate a virtual mailbox user (we'll say `user(a)example.net` who only has a virtual mailbox). [1]This documentation page describes the process to configure multiple authentication databases. It describes being able to use multiple `passdb` and `userdb` sections in order to authenticate dovecot users. Based upon what it suggested, I tried this configuration: ## Snippet from /etc/dovecot/dovecot.conf ## passdb passwd-file { # So [2]example.net => /etc/dovecot/passwd/example.net passwd_file_path = /etc/dovecot/passwd/%{user | domain} } # Fall thru to PAM for unix users passdb pam { } userdb passwd-file { passwd_file_path = /etc/dovecot/passwd/%{user | domain} } # Fall thru to /etc/passwd for unix users userdb passwd { } ## Snippet from /etc/dovecot/passwd/example.net ## [3]support@example.net:$y$j9...hash...:800:800::/var/postfix/virtual/example.net/support:: This is the configuration I landed on that hypothetically checks multiple databases for authentication that allows at least `user(a)example.com` to still login with Thunderbird and do email stuff. However it does not authenticate `user(a)example.net`. The biggest difference between my config and the example is that they use a `sql` database while I am trying the `passwd-file` database. In principle this seems like it should work, unless I am understanding the dovecot docs or have made my passwd file incorrectly. I even tried reversing the order of `userdb` and `passdb` sections to see if it would help to no avail. [4]This thread seems to address a similar issue, and more or less has the same configuration setup suggested as the one in the snippet above. It's also from 2006 so the API looks kinda different from the current docs. [5]This thread is from 2013 addressing a similar issue, but despite again different API it translates to more or less what the snippet above shows. Here is the journalctl output from when I tried to login as `user(a)example.net`: # journalctl -xeu dovecot | tail Dec 29 11:38:19 [6]example.com auth[4719]: pam_unix(dovecot:auth): check pass; user unknown Dec 29 11:38:19 [7]example.com auth[4719]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot [8]ruser=user(a)example.net rhost=10.0.0.1 Dec 29 11:38:28 [9]example.com auth[4719]: pam_unix(dovecot:auth): check pass; user unknown Dec 29 11:38:28 [10]example.com auth[4719]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot [11]ruser=user(a)example.net rhost=10.0.0.1 Dec 29 11:41:19 [12]example.com dovecot[4700]: imap-login: Login aborted: Inactivity (auth failed, 2 attempts in 180 secs) (auth_failed): user=<[13]user(a)example.net>, method=LOGIN, rip=10.0.0.1, lip=10.0.0.2, TLS, session=<z8Tj3hlHkLxJMmuL> The last message referring to "Inactivity" is because at that point fail2ban blocked my IP, but before that it was consistent with results I have been getting. I'm at an absolute loss. I feel like I've trawled every doc I could find, every config file involved in the setup process, all the Stack Exchange answers that seem to exist. Honestly it baffles me to see that even what looks like the same setup as official documentation, it just doesn't... work? Can anybody point to me what is going wrong? Thanks for reading, ~ Ethan Merrill References Visible links 1. This documentation page https://doc.dovecot.org/2.4.2/core/config/auth/mutltiple.html 2. http://example.net/ 3. mailto:support@example.net 4. This thread https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/VMXU2… 5. This thread https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/YO3DF… 6. http://example.com/ 7. http://example.com/ 8. mailto:ruser=user@example.net 9. http://example.com/ 10. http://example.com/ 11. mailto:ruser=user@example.net 12. http://example.com/ 13. mailto:user@example.net

6 10