- dovecot - dovecot.org

Problem with authentication in dovecot
by Freek de Kruijf 22 May '26

22 May '26

I have the following dovecot.conf, striped from comment: dovecot_config_version = 2.4.2 dovecot_storage_version = 2.4.0 protocols = imap auth_allow_cleartext = yes auth_mechanisms = plain auth_verbose = yes mail_plugin_dir = /usr/lib64/dovecot/modules namespace inbox { inbox = yes mail_driver = maildir mail_path = ~/Maildir prefix = INBOX. mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } } passdb pam { service_name = dovecot } userdb passwd { use_worker = yes } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } ssl = yes ssl_server { cert_file = /etc/letsencrypt/live/<mydomain>/fullchain.pem dh_file = /etc/dovecot/dh.pem key_file = /etc/letsencrypt/live/<mydomain>/privkey.pem } sieve_script personal { active_path = ~/.dovecot.sieve driver = file path = ~/sieve } When connecting my email client to dovecot, the connection succeeds, but after awhile it disconnects. In /var/log/dovecot I get: May 18 17:36:15 imap-login: Warning: Auth process not responding, delayed sending initial response (greeting): user=<>, rip=192.168.178.6, lip=192.168.178.15, session=<2IMbUhlS8K3AqLIG> May 18 17:36:45 imap-login: Info: Login aborted: Connection closed (disconnected before auth was ready, waited 40 secs) (auth_process_not_ready): user=<>, rip=192.168.178.6, lip=192.168.178.15, session=<2IMbUhlS8K3AqLIG> May 18 17:36:45 imap-login: Error: auth-client: conn unix:login: connect(login) in directory / failed: Permission denied (euid=473(<getpwuid() error>) egid=473(<getgrgid() error>) missing +x perm: /, we're not in group 474, dir owned by 0:474 mode=0750) May 18 17:36:45 imap-login: Error: auth-client: conn unix:login: connect(login) in directory / failed: Permission denied (euid=473(<getpwuid() error>) egid=473(<getgrgid() error>) missing +x perm: /, we're not in group 474, dir owned by 0:474 mode=0750) 473 is connected with account/group dovenull an 474 is connected with account/group dovecot I can't find a solution when searching the internet. -- fr.gr. member openSUSE Freek de Kruijf I have the following dovecot.conf, striped from comment: dovecot_config_version = 2.4.2 dovecot_storage_version = 2.4.0 protocols = imap auth_allow_cleartext = yes auth_mechanisms = plain auth_verbose = yes mail_plugin_dir = /usr/lib64/dovecot/modules namespace inbox { inbox = yes mail_driver = maildir mail_path = ~/Maildir prefix = INBOX. mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } } passdb pam { service_name = dovecot } userdb passwd { use_worker = yes } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } ssl = yes ssl_server { cert_file = /etc/letsencrypt/live/<mydomain>/fullchain.pem dh_file = /etc/dovecot/dh.pem key_file = /etc/letsencrypt/live/<mydomain>/privkey.pem } sieve_script personal { active_path = ~/.dovecot.sieve driver = file path = ~/sieve } When connecting my email client to dovecot, the connection succeeds, but after awhile it disconnects. In /var/log/dovecot I get: May 18 17:36:15 imap-login: Warning: Auth process not responding, delayed sending initial response (greeting): user=<>, rip=192.168.178.6, lip=192.168.178.15, session=<2IMbUhlS8K3AqLIG> May 18 17:36:45 imap-login: Info: Login aborted: Connection closed (disconnected before auth was ready, waited 40 secs) (auth_process_not_ready): user=<>, rip=192.168.178.6, lip=192.168.178.15, session=<2IMbUhlS8K3AqLIG> May 18 17:36:45 imap-login: Error: auth-client: conn unix:login: connect(login) in directory / failed: Permission denied (euid=473(<getpwuid() error>) egid=473(<getgrgid() error>) missing +x perm: /, we're not in group 474, dir owned by 0:474 mode=0750) May 18 17:36:45 imap-login: Error: auth-client: conn unix:login: connect(login) in directory / failed: Permission denied (euid=473(<getpwuid() error>) egid=473(<getgrgid() error>) missing +x perm: /, we're not in group 474, dir owned by 0:474 mode=0750) 473 is connected with account/group dovenull an 474 is connected with account/group dovecot I can't find a solution when searching the internet. -- fr.gr. member openSUSE Freek de Kruijf

3 4

Regression/Bug report: crypt_private_key_file (for crypt_global_private_key) no longer supports inline base64 (from userdb) in dev branch
by Ömer Güven 22 May '26

22 May '26

Hi, I’ve run into what appears to be a regression (or at least a behavioral change) in Dovecot 3.3.0+ / current HEAD regarding crypt_private_key_file handling for the crypt_global_private_key. I don‘t use per-folder user keys but a global encryption key per user. Previously, it was possible to provide the private key via userdb using an inline base64:-encoded PEM directly to the crypt_global_private_key_file and Dovecot would correctly parse and use it. With the latest config scheme change, this no longer works, as you cannot really set named config variables from userdb. I did workaround by setting a custom userdb variable and setting the needed named/filter variables manually in the config file. To make it work, I had to enclose the config in a „protocol imap“ scope. The crypt_global_public_key_file is accessible from userdb (as it is not within a named filter scope), so inline-base64 works as with Dovecot 2.3+. When using the following workaround to reach the scoped variables, Dovecot tries to load the file „inline:BASE64ENCODEDPEM“ as a literal filename (error open(inline:AB….C==) failed): protocol imap { crypt_global_private_key user { crypt_private_key_file = %{userdb:private_key_file} crypt_private_key_password = %{userdb:private_key_password} } } As a workaround, I now have to: • store the private key as a file (e.g. %{home}/privkey.pem) • pass only the password via userdb • inject the path indirectly via static config + userdb variables This works, but is less elegant: protocol imap { crypt_global_private_key user { crypt_private_key_file = %{home}/privkey.pem crypt_private_key_password = %{userdb:private_key_password} } } Again, with the new named filter mechanism, it’s no longer possible to directly inject such config values via userdb, which makes fully dynamic per-user key provisioning harder. I now have to export all encrypted private keys from the database to the users home directory. Ömer Hi, I've run into what appears to be a regression (or at least a behavioral change) in Dovecot 3.3.0+ / current HEAD regarding crypt_private_key_file handling for the crypt_global_private_key. I don`t use per-folder user keys but a global encryption key per user. Previously, it was possible to provide the private key via userdb using an inline base64:-encoded PEM directly to the crypt_global_private_key_file and Dovecot would correctly parse and use it. With the latest config scheme change, this no longer works, as you cannot really set named config variables from userdb. I did workaround by setting a custom userdb variable and setting the needed named/filter variables manually in the config file. To make it work, I had to enclose the config in a "protocol imap" scope. The crypt_global_public_key_file is accessible from userdb (as it is not within a named filter scope), so inline-base64 works as with Dovecot 2.3+. When using the following workaround to reach the scoped variables, Dovecot tries to load the file "inline:BASE64ENCODEDPEM" as a literal filename (error open(inline:AB....C==) failed): protocol imap { crypt_global_private_key user { crypt_private_key_file = %{userdb:private_key_file} crypt_private_key_password = %{userdb:private_key_password} } } As a workaround, I now have to: o store the private key as a file (e.g. %{home}/privkey.pem) o pass only the password via userdb o inject the path indirectly via static config + userdb variables This works, but is less elegant: protocol imap { crypt_global_private_key user { crypt_private_key_file = %{home}/privkey.pem crypt_private_key_password = %{userdb:private_key_password} } } Again, with the new named filter mechanism, it's no longer possible to directly inject such config values via userdb, which makes fully dynamic per-user key provisioning harder. I now have to export all encrypted private keys from the database to the users home directory. Oemer

4 11

warning: /usr/lib/postfix/sbin/virtual: bad command startup -- throttling
by David Koski 22 May '26

22 May '26

Hello, I have set up a new dovecot mail server using MySQL backend. All users, passwords and related data are in SQL. I'm seeing the following warning in the mail.log file: warning: /usr/lib/postfix/sbin/virtual: bad command startup -- throttling It appears to have no impact on mail delivery. Since paths to user directories are yielded by the SQL database, I'm left wondering why this is even a warning. Regards, David Koski dkoski(a)sutinen.com # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.12.69+deb13-amd64 x86_64 Debian 13.5 # Hostname: B914839.online-server.cloud # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login gssapi cram-md5 digest-md5 debug_log_path = /var/log/dovecot/debug.log default_vsz_limit = 512M dovecot_storage_version = 2.4.0 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes info_log_path = /var/log/dovecot/info.log lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes log_debug = category=auth log_path = /var/log/dovecot/dovecot.log mail_driver = maildir mail_plugins { quota = yes } mailbox_directory_name_legacy = no protocols { imap = yes lmtp = yes sieve = yes } quota_exceeded_message = User %{user} has exceeded the storage volume. / User %{user} has exhausted allowed storage space. sieve_plugins { sieve_imapsieve = yes sieve_extprograms = yes } sql_driver = mysql ssl = required namespace inbox { inbox = yes prefix = separator = . type = private mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Outbox { special_use = "\\Drafts" } mailbox Junk { auto = subscribe special_use = "\\Junk" } mailbox "Junk Email" { auto = no special_use = "\\Junk" } mailbox "Junk E-mail" { auto = no special_use = "\\Junk" } mailbox Trash { auto = subscribe special_use = "\\Trash" } mailbox "Deleted Items" { auto = no special_use = "\\Trash" } mailbox Spam { auto = no special_use = "\\Junk" } mailbox Archives { auto = no special_use = "\\Archive" } mailbox Sent { auto = subscribe special_use = "\\Sent" } mailbox "Sent Items" { auto = no special_use = "\\Sent" } mailbox "Sent Messages" { auto = no special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service pop3-login { inet_listener pop3 { } inet_listener pop3s { } } service submission-login { inet_listener submission { } inet_listener submissions { } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { group = postfix } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { cert_file = /etc/letsencrypt/live/mail.sutinen.com/fullchain.pem key_file = /etc/letsencrypt/live/mail.sutinen.com/privkey.pem } protocol lda { mail_plugins { sieve = yes quota = yes } } protocol imap { mail_plugins { imap_sieve = yes } } protocol lmtp { mail_plugins { quota = yes sieve = yes notify = yes push_notification = yes } postmaster_address = postmaster(a)sutinen.com } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service managesieve { } sieve_script personal { active_path = /var/vmail/sieve/%{user | domain }/%{user | username }/active-script.sieve driver = file path = /var/vmail/sieve/%{user | domain }/%{user | username }/scripts type = personal } sieve_script spam-global { path = /var/vmail/sieve/global/spam-global.sieve type = before } mailbox Spam { sieve_script spam { cause = copy path = /var/vmail/sieve/global/learn-spam.sieve type = before } } imapsieve_from Spam { sieve_script ham { cause = copy path = /var/vmail/sieve/global/learn-ham.sieve type = before } } mysql /var/run/mysqld/mysqld.sock { dbname = vmail password = # hidden, use -P to show it user = vmail } passdb sql { driver = sql query = CALL password_query('%{user}', '%{password}') } userdb sql { driver = sql query = CALL user_query_dovecot('%{user | username}', '%{user | domain}') }

3 2

Dovecot 2.4 authentication
by David Koski 22 May '26

22 May '26

Hello, I just put a new Postfix with Dovecot 2.4 server on line migrating the email from Dovecot 2.3. I have discovered a number of clients (all copiers so far) that no longer authenticate SMTP. Mechanisms configured: auth_mechanisms = plain login gssapi cram-md5 digest-md5 I found that if I disable all encrypted password methods (some copiers list them separately with a checkbox) and leave only plain/login on the client side, then it succeeds. But sometimes it is not necessary. It's almost as if it only tries once and gives up if it fails. I'm not sure how it is actually supposed to work. But it worked with Dovecot 2.3. I did test one account with an encrypted password like "{CRAM-MD5}6e3..." successfully. But other accounts failed. It almost looks like the encryption method must be specified on the client side to match the server before it will work consistently. I know that password encryption is unnecessary with STARTTLS but I have to live with it now. I have noticed that Thunderbird configured with encryption silently falls back to plain/login so I didn't notice a problem. Regards, David Koski dkoski(a)sutinen.com

2 4

dovecot 2.4 Restricting Access - journal/log differences for failed login?
by David C Rankin 21 May '26

21 May '26

All, I have restricted access for several users using the Restring Access documentation https://doc.dovecot.org/2.4.0/howto/restrict_access.html This was to cut down on the brute-force attempts against dovecot for certain users whose usernames/e-mails are routinely used. I have a very simply passdb config: passdb passwd-file { passwd_file_path = /etc/dovecot/deny.%{protocol} deny = yes } passdb pam { driver = pam } userdb pam { driver = passwd } I created the /etc/dovecot/deny.imap file with one username per-line. But what confuses me is the server logs the exact same failure for unsuccessful login after restricting access as it did before restricting access. E.g. 2026-05-20T07:22:43.039585-05:00 valkyrie auth[28618]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=janice(a)mydomain.com rhost=70.186.179.37 2026-05-20T07:22:51.578711-05:00 valkyrie auth[28618]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=janice(a)mydomain.com rhost=70.186.179.37 May 20 07:25:36 valkyrie dovecot[1015]: imap-login: Login aborted: Inactivity (auth failed, 2 attempts in 177 secs) (auth_failed): user=<janice(a)mydomain.com>, method=PLAIN, rip=70.186.179.37, lip=192.168.6.14, TLS, session=<ouXP2T5SJpZGurMl> Is this normal, or should dovecot respond to restricted users in some way that differs from a normal login failure? All could be working fine, I'm just not certain about the log entries. -- David C. Rankin, J.D.,P.E.

1 0

"imap" command not usable in dovecot 2.4
by Mark Hills 20 May '26

20 May '26

Since upgrading to 2.4 (from 2.3) the "imap" command no longer works: $ /usr/libexec/dovecot/imap * PREAUTH [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE REPLACE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW SPECIAL-USE STATUS=SIZE SAVEDATE COMPRESS=DEFLATE INPROGRESS NOTIFY LITERAL+] Logged in as mark imap(mark)<6109><5GlNEEHaDWrdFwAABxE9Dg>: Fatal: Namespace inbox: mail_storage settings: Failed to parse configuration: Invalid setting mail_path=~/Maildir: mail_path setting used home directory (~/) but there is no mail_home and userdb didn't return it Whereas I would expect an authenticated IMAP session. Removing the offending /etc/dovecot.conf line temporarily: dovecot_config_version = 2.4.1 dovecot_storage_version = 2.4.0 protocols = imap lmtp sieve mail_driver = maildir #mail_path = ~/Maildir passdb passwd-file { passwd_file_path = /etc/dovecot/passwd } userdb passwd { } [...] And re-testing suggests the cause runs deeper: $ /usr/lib/exec/dovecot/imap [...] imap(mark)<6364><tetIC6/aDWrcGAAABxE9Dg>: Fatal: Namespace inbox: mail_storage settings: Failed to parse configuration: Failed to expand mail_path setting variables: Setting used home directory (%h) but there is no mail_home and userdb didn't return it Attempts to hard-wire it seem to suggest that usedb is not involved. I imagine this may be not consulted, because the process is pre-authenticated and running as a local UID: userdb passwd { fields_import_all = no fields { mail_home = /home/mark mail_path = /home/mark/Maildir } } $ /usr/libexec/dovecot/imap [...] imap(mark)<6656><qPqUB17cDWoAGgAABxE9Dg>: Fatal: Namespace inbox: mail_storage settings: Failed to parse configuration: Failed to expand mail_path setting variables: Setting used home directory (%h) but there is no mail_home and userdb didn't return it It seems like 2.3 looked up these fields from the user invoking it, but no longer is this the case? Running "imap" like this is very useful, especially when a client like Pine/Alpine can access over SSH. To get to here I had to workaround the missing "shadow" passdb module, which is also useful as Alpine Linux 3.23 neither uses PAM extensively nor provides dovecot built with PAM. -- Mark

1 0

undocumented changed behavior of 2.4.3 (possible bug report)
by Patrick Cernko 20 May '26

20 May '26

Hello Dovecot-Devs, hello list, while upgrading my Dovecot 2.4.2 setup to 2.4.3 I observed two instances of changed behavior. I could not find notes about those issues in the corresponding documentation (https://doc.dovecot.org/2.4.3/installation/upgrade/2.4-to-2.4.x.html) or release notes: 1. I had to change userdb_ldap_iterate_filter = (&(objectClass=posixAccount)%{if(protocol,"eq","pop3","(istIsMemberOf=POP3-users)","")}) to userdb_ldap_iterate_filter = (&(objectClass=posixAccount)%{if(protocol,"eq","pop3","(istIsMemberOf=POP3-users)","")|safe) otherwise the characters '()=' in the "true"-case of the condition got somehow "quoted" with escaped ASCII codes, which led to a broken LDAP filter string. Maybe you could add some documentation (in "Upgrading" as well as "Settings Variables") about that? 2. The behavior of sieve matches using ":matches" has changed: Example email (only the relevant header): List-Id: Dovecot Mailing List <dovecot.dovecot.org> Example Sieve script: if header :matches "List-Id" "*<dovecot*.dovecot.org>" { fileinto "dovecot"; } In 2.4.2 (and earlier) the example email matched the condition and got stored in the dovecot folder, while in 2.4.3 the condition does NOT match. As a workaround I added a '*' at the end of the match ("*<dovecot*.dovecot.org>*") to get my mails stored correctly again. Is this changed behavior for Sieve intentional or a bug? In case of a bug, could you please provide a fix? In case of intentional behavior: * Could you please explain the intention? Why was it necessary? * What would be the correct fix for the sieve example to match a List-Id header that ENDS WITH ".dovecot.org>"? * I assume, that other users on my servers will run into similar problems once I upgrade their servers. Is it possible to detect such problematic matches in Sieve scripts? E.g. "all matches without a trailing '*' are affected", ... This would give me a chance, to inform my users or even fix their scripts in advance. Best regards, -- Patrick Cernko <pcernko(a)mpi-klsb.mpg.de> +49 681 9325 5815 Joint Scientific IT and Technical Service Max-Planck-Institute für Informatik & Softwaresysteme

2 3

flatcurve index size (10x larger than lucene)
by Jean-Daniel Beaubien 18 May '26

18 May '26

Hi everyone, I am currently trying to update from an old dovecot 2.3 setup with fts-lucene to 2.4.2 with fts-flatcurve. However, I am seeing a giant jump in the size of the indexes. For an email account that takes 12GB of storage, I get the following index sizes: - lucene: 270 MB - flatcurve: 2400 MB That is almost a 10x increase in the index size (with flatcurve the indexes represent 20% of the size of the mailbox). Considering I have a mailbox that takes 270GB, I can't imagine the size of the indexes. *Am I doing something wrong with flatcurve? How can the indexes be so much larger than lucene?* I took the default flatcurve configuration from the Ubuntu 26.04 install: mail_plugins { fts = yes fts_flatcurve = yes } fts_autoindex = yes language_filters = normalizer-icu snowball stopwords language_tokenizers = generic email-address language_tokenizer_generic_algorithm = simple language en { default = yes filters = lowercase snowball english-possessive stopwords } fts flatcurve { # All of these are optional, and indicate the default values. # They are listed here for documentation purposes; most people should not # need to define/override in their config. # commit_limit = 500 # max_term_size = 30 # min_term_size = 2 # optimize_limit = 10 # rotate_count = 5000 # rotate_time = 5000 substring_search = yes } *Any help/insight would be greatly appreciated.* Best regards, -J Hi everyone, I am currently trying to update from an old dovecot 2.3 setup with fts-lucene to 2.4.2 with fts-flatcurve. However, I am seeing a giant jump in the size of the indexes. For an email account that takes 12GB of storage, I get the following index sizes: o lucene: 270 MB o flatcurve: 2400 MB That is almost a 10x increase in the index size (with flatcurve the indexes represent 20% of the size of the mailbox). Considering I have a mailbox that takes 270GB, I can't imagine the size of the indexes. Am I doing something wrong with flatcurve? How can the indexes be so much larger than lucene? I took the default flatcurve configuration from the Ubuntu 26.04 install: mail_plugins { fts = yes fts_flatcurve = yes } fts_autoindex = yes language_filters = normalizer-icu snowball stopwords language_tokenizers = generic email-address language_tokenizer_generic_algorithm = simple language en { default = yes filters = lowercase snowball english-possessive stopwords } fts flatcurve { # All of these are optional, and indicate the default values. # They are listed here for documentation purposes; most people should not # need to define/override in their config. # commit_limit = 500 # max_term_size = 30 # min_term_size = 2 # optimize_limit = 10 # rotate_count = 5000 # rotate_time = 5000 substring_search = yes } Any help/insight would be greatly appreciated. Best regards, -J

3 3

[Dovecot] batch convert mbox to maildir
by Netlink Tech 18 May '26

18 May '26

Hello, I have used mb2md for an individual user like this: su ~username cd ~ ./mb2md -m This converted /var/spool/mail/username mbox to /home/users/username/Maildir just as I expected. To convert 100s of users the same way would be a chore (su as each user for permissions, etc.). Is there a way to batch process all /var/spool/mail/$USER to /home/users/$USER/Maildir with the correct permissions/file owners for each user?

4 4

Lua authentication
by John Fawcett 18 May '26

18 May '26

Hi I'm finally getting round to taking up Aki's suggestion here to look into lua. The original requirement was to check the ip reputation giving an OK or KO before proceeding to the login. I'd be interested in any feedback on the dovecot.conf settings and lua script. Also I've encountered a strange caching issue. https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/E5FLX… To do this I've added a new passdb before the existing sql passdb. I am assuming that I will need to reverse the defaults (in 2.3.21.1) for result_success and result_failure. passdb { driver = lua args = file=/etc/dovecot/passdb.lua blocking=yes result_success = continue result_failure = return-fail } This is my lua test script. function auth_passdb_lookup(req) dovecot.i_info("login request from " .. req.remote_ip .. " user=" .. req.user) if (req.user == "user_to_deny(a)example.com") then dovecot.i_info("deny login") return dovecot.auth.PASSDB_RESULT_USER_UNKNOWN, "" end return dovecot.auth.PASSDB_RESULT_NEXT, "" end I am trying to get this working with this very simple logic before developing the real logic. But basically I am considering two responses from the lua script, one which is OK (returning dovecot.auth.PASSDB_RESULT_NEXT) in which case the next passdb should be consulted for the real password lookup. The other case is a KO (returning dovecot.auth.PASSDB_RESULT_USER_UNKNOWN) where this should be taken as an immediate failure without proceeding to password lookup in the next passd.I have passdb caching disabled. While testing the KO case which seems to be working, if I modify the script changing the user_to_deny(a)example.com so it no longer matches, the script still outputs "deny login". It's not a passdb caching issue since it is going through the "deny login" code despite the user not matching. Could it be that lua scripts are being cached by dovecot? John

1 0