On Sun, Aug 23, 2026 at 01:12:42PM +0300, Aki Tuomi via dovecot wrote:
On 22/08/2026 21:57 EEST The Doctor via dovecot <dovecot@dovecot.org> wrote:
On Sat, Aug 22, 2026 at 07:36:25PM +0300, Aki Tuomi wrote:
On 22/08/2026 16:28 EEST The Doctor via dovecot <dovecot@dovecot.org> wrote:
On Sat, Aug 22, 2026 at 10:02:29AM +0200, Kurt Jaeger wrote:
Hi!
Something is not correct.
Dovecot 2.3 ports does work, but not the 2.4 ports
dovecot 2.4 is really not a simple upgrade. The config files need to be changed in some manner.
Here are errors I am seeing [...] lain): Finished plain passdb verification (status=user-unknown) Aug 21 15:01:01 auth(dave,10.14.0.4,sasl:plain)<f5oT75RZzsYKDgAE>: Debug: sasl(plain): Interaction failed
So your passdb lookup failed. Did you change anything in your configs to adapt to the new syntax ?
https://doc.dovecot.org/2.4.0/installation/upgrade/2.3-to-2.4.html
Let me read.
I did the conversion and the LLMs are really of no help.
-- pi@FreeBSD.org +49 171 3101372 Now what ?
--
We provide a conversion tool at https://dovecot.org/upgrader/ - that might be useful for you.
Did that already.
Aki
How about showing the new config then? Might be easier to help fix it.
Aki
all right
Dovecot 2.3
#5 2.0.0: dovecot.conf
OS: BSD/OS 4.3 i386
auth_cache_negative_ttl = 3600 s base_dir = /var/run/dovecot/ disable_plaintext_auth = no first_valid_uid = 100 info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log listen = * #listen = [::] #listen = 10.0.0.1, 127.0.0.1 login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c mail_debug=yes mail_location = mbox:~/mail:INBOX=/var/mail/%u ##mail_location = mbox:/var/mail/%u:INBOX=/var/mail/%u mail_log_prefix = %Us(%u): mdbox_rotate_size = 2048 passdb { args = /etc/master.passwd driver = passwd-file } protocols = imap pop3 lmtp protocol lda { # Support for dynamically loadable plugins. mail_plugins is # a space separated list of plugins to load. mail_plugins = sieve # ... other plugins like quota }
service auth { executable = /usr/dovecot2/libexec/dovecot/auth user = root ##vsz_limit = 256 } service imap-login { chroot = login client_limit = 256 inet_listener imap { address = 10.0.0.1, 127.0.0.1 port = 143 } inet_listener imaps { address = 10.0.0.1, 10.0.0.235, 10.0.0.237, 10.0.0.110, 10.0.0.249, 10.0.0.240, 127.0.0.1 port = 993 ssl = yes } executable = /usr/dovecot2/libexec/dovecot/imap-login process_limit = 128 process_min_avail = 3 service_count = 1 user = dovecot ##vsz_limit = 1M } service imap { executable = /usr/dovecot2/libexec/dovecot/imap process_limit = 512 ##vsz_limit = 256 } ssl = yes ssl_cert = </path/to/ssl/certs/2026/nk.ca/crt ssl_cipher_list = TLSv1.2+AESGCM+ECDHE:TLSv1.3+AESGCM+CHACHA20 ssl_curve_list = X25519:secp384r1 ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = no ssl_key = </path/to/ssl/keys/2026/nk.ca/key verbose_ssl = yes ssl_dh=</usr/dovecot2/etc/dovecot/ssl/dh.pem userdb { driver = passwd } userdb { args = /etc/passwd driver = passwd-file }
local 10.0.0.1 { protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep imap_idle_notify_interval = 120 s imap_logout_format = bytes=%i/%o imap_max_line_length = 65536 mail_max_userip_connections = 10 mail_plugin_dir = /usr/dovecot2/lib/dovecot/imap ##local_name imap.acebizventures.com { ##ssl_cert = </path/to/ssl/certs/wildcard.acebizventures.com.2022.chain.cert ##ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:aNULL: !NULL : !RC2 : !RC4 : !SEED : !IDEA : !SSLv3 ##ssl_key = </path/to/ssl/certs/wildcard.acebizventures.com.2019.key ##} ssl_cert = </path/to/ssl/certs/2026/nk.ca/crt ssl_cipher_list = TLSv1.2+AESGCM+ECDHE:TLSv1.3+AESGCM+CHACHA20 ssl_curve_list = X25519:secp384r1 ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = no ssl_key = </path/to/ssl/keys/2026/nk.ca/key ssl_dh=</usr/dovecot2/etc/dovecot/ssl/dh.pem verbose_ssl = yes } }
local 10.0.0.235 { protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep imap_idle_notify_interval = 120 s imap_logout_format = bytes=%i/%o imap_max_line_length = 65536 mail_max_userip_connections = 10 mail_plugin_dir = /usr/dovecot2/lib/dovecot/imap ssl_cert = </path/to/ssl/certs/2024/performanceplanning.ca/chain.cert ssl_cipher_list = TLSv1.2+AESGCM+ECDHE:TLSv1.3+AESGCM+CHACHA20 ssl_curve_list = X25519:secp384r1 ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = no ssl_key = </path/to/ssl/keys/2022/performanceplanning.ca/key.orig ssl_dh=</usr/dovecot2/etc/dovecot/ssl/dh.pem verbose_ssl = yes
} }
local 10.0.0.237 { protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep imap_idle_notify_interval = 120 s imap_logout_format = bytes=%i/%o imap_max_line_length = 65536 mail_max_userip_connections = 10 mail_plugin_dir = /usr/dovecot2/lib/dovecot/imap ssl_cert = </path/to/ssl/certs/2025/acebizventures/cert ssl_cipher_list = TLSv1.2+AESGCM+ECDHE:TLSv1.3+AESGCM+CHACHA20 ssl_curve_list = X25519:secp384r1 ssl_key = </path/to/ssl/keys/2022/acebizventures.com/key ssl_dh=</usr/dovecot2/etc/dovecot/ssl/dh.pem verbose_ssl = yes
} }
local 10.0.0.110 { protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep imap_idle_notify_interval = 120 s imap_logout_format = bytes=%i/%o imap_max_line_length = 65536 mail_max_userip_connections = 10 mail_plugin_dir = /usr/dovecot2/lib/dovecot/imap ssl_cert = </path/to/ssl/certs/2026/pdsolutions/cert ssl_cipher_list = TLSv1.2+AESGCM+ECDHE:TLSv1.3+AESGCM+CHACHA20 ssl_curve_list = X25519:secp384r1 ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = no ssl_key = </path/to/ssl/keys/2022/pdsolutions.ca/key ssl_dh=</usr/dovecot2/etc/dovecot/ssl/dh.pem verbose_ssl = yes
} }
local 10.0.0.240 { protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep imap_idle_notify_interval = 120 s imap_logout_format = bytes=%i/%o imap_max_line_length = 65536 mail_max_userip_connections = 10 mail_plugin_dir = /usr/dovecot2/lib/dovecot/imap ssl_cert = </path/to/ssl/certs/2026/cellsonic/cert ssl_key = </path/to/ssl/keys/2026/cellsonic/key ssl_cipher_list = TLSv1.2+AESGCM+ECDHE:TLSv1.3+AESGCM+CHACHA20 ssl_curve_list = X25519:secp384r1 ssl_dh=</usr/dovecot2/etc/dovecot/ssl/dh.pem verbose_ssl = yes
} }
plugin { home=/usr/dovecot2 }
service pop3-login {
chroot = login
client_limit = 256
inet_listener pop3 {
address = 10.0.0.1
port = 110
}
inet_listener pop3s {
address = 10.0.0.1
port = 995
ssl = yes
}
executable = /usr/dovecot2/libexec/dovecot/pop3-login
process_limit = 128
process_min_avail = 4
service_count = 1
user = dovecot
##vsz_limit = 64
}
service pop3 { executable = /usr/dovecot2/libexec/dovecot/pop3 process_limit = 512 ##vsz_limit = 256 }
##local 10.0.0.* {
POP3 specific settings
protocol pop3 {
Don't try to set mails non-recent or seen with POP3 sessions. This is
mostly intended to reduce disk I/O. With maildir it doesn't move files
from new/ to cur/, with mbox it doesn't write Status-header.
pop3_no_flag_updates = yes
Support LAST command which exists in old POP3 specs, but has been removed
from new ones. Some clients still wish to use this though. Enabling this
makes RSET command clear all \Seen flags from messages.
pop3_enable_last = yes
If mail has X-UIDL header, use it as the mail's UIDL.
pop3_reuse_xuidl = yes
Keep the mailbox locked for the entire POP3 session.
pop3_lock_session = no
POP3 UIDL (unique mail identifier) format to use. You can use following
variables, along with the variable modifiers described in
doc/wiki/Variables.txt (e.g. %Uf for the filename in uppercase)
%v - Mailbox's IMAP UIDVALIDITY
%u - Mail's IMAP UID
%m - MD5 sum of the mailbox headers in hex (mbox only)
%f - filename (maildir only)
%g - Mail's GUID
If you want UIDL compatibility with other POP3 servers, use:
UW's ipop3d : %08Xv%08Xu
Courier : %f or %v-%u (both might be used simultaneosly)
Cyrus (<= 2.1.3) : %u
Cyrus (>= 2.1.4) : %v.%u
Dovecot v0.99.x : %v.%u
tpop3d : %Mf
Note that Outlook 2003 seems to have problems with %v.%u format which was
Dovecot's default, so if you're building a new server it would be a good
idea to change this. %08Xu%08Xv should be pretty fail-safe.
pop3_uidl_format = %08Xu%08Xv
Permanently save UIDLs sent to POP3 clients, so pop3_uidl_format changes
won't change those UIDLs. Currently this works only with Maildir.
pop3_save_uidl = no
POP3 logout format string:
%i - total number of bytes read from client
%o - total number of bytes sent to client
%t - number of TOP commands
%p - number of bytes sent to client as a result of TOP command
%r - number of RETR commands
%b - number of bytes sent to client as a result of RETR command
%d - number of deleted messages
%m - number of messages (before deletion)
%s - mailbox size in bytes (before deletion)
%u - old/new UIDL hash. may help finding out if UIDLs changed unexpectedly
pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s
Maximum number of POP3 connections allowed for a user from each IP address.
NOTE: The username is compared case-sensitively.
mail_max_userip_connections = 3
Space separated list of plugins to load (default is global mail_plugins).
mail_plugins = $mail_plugins
Workarounds for various client bugs:
outlook-no-nuls:
Outlook and Outlook Express hang if mails contain NUL characters.
This setting replaces them with 0x80 character.
oe-ns-eoh:
Outlook Express and Netscape Mail breaks if end of headers-line is
missing. This option simply sends it if it's missing.
The list is space-separated.
pop3_client_workarounds = outlook-no-nuls oe-ns-eoh ## oe6-fetch-no-newmail #local_name pop3.acebizventures.com { #ssl_cert = </path/to/ssl/certs/wildcard.acebizventures.com.2020.chain.cert #ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:aNULL: !NULL : !RC2 : !RC4 : !SEED : !IDEA : !SSLv3 #ssl_key = </path/to/ssl/certs/wildcard.acebizventures.com.2019.key #} ssl_cert = </path/to/ssl/certs/2026/nk.ca/crt ssl_key = </path/to/ssl/keys/2026/nk.ca/key ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = no ssl_cipher_list = TLSv1.2+AESGCM+ECDHE:TLSv1.3+AESGCM+CHACHA20 ssl_curve_list = X25519:secp384r1 ssl_dh=</usr/dovecot2/etc/dovecot/ssl/dh.pem verbose_ssl = yes }
service lmtp { process_min_avail = 5 inet_listener lmtp { address = 10.0.0.1 127.0.0.1 port = 24 } executable = lmtp -L unix_listener lmtp { #mode = 0666 } }
protocol lmtp { info_log_path = /var/log/dovecot-lmtp.log
use %Ln to strip away the domain part
auth_username_format = %Lu }
##}
New Dovecot 2.4 conf
Conversion performed at 2026-08-21 19:32:14.241889
dovecot_config_version = 2.4.2 dovecot_storage_version = 2.4.0 auth_allow_cleartext = yes auth_cache_negative_ttl = 3600 s base_dir = /var/run/dovecot/ first_valid_uid = 100 info_log_path = /var/log/dovecot-info.log listen = * log_debug = category=auth log_debug = category=ssl log_debug = category=mail log_path = /var/log/dovecot.log login_log_format_elements = user=<%{user}> method=%{mechanism} rip=%{remote_ip} lip=%{local_ip} %{secured} mail_driver = mbox mail_inbox_path = /var/mail/%{user} mail_log_prefix = %{protocol | upper}(%{user}): mail_path = ~/mail mdbox_rotate_size = 2048 protocols = imap pop3 lmtp
Standard modern cipher suite for OpenSSL / Dovecot
ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 ssl_curve_list = X25519:secp384r1 ssl_min_protocol = TLSv1.2 #ssl_prefer_server_ciphers = no #verbose_ssl = yes
#auth_default_realm = nk.ca
auth_cache_size = 0
service auth { user = root }
auth_verbose = yes auth_debug = yes auth_debug_passwords = yes
#passdb passwd-file {
driver = passwd-file
passwd_file_path = scheme=CRYPT format=%u:%p username_format=%n /etc/master.passwd
#args = scheme=CRYPT format=%u:%p /etc/master.passwd #}
passdb system_passwd { driver = passwd-file passwd_file_path = /etc/master.passwd default_password_scheme = CRYPT auth_username_format = %{user | username} }
userdb system_passwd { driver = passwd-file passwd_file_path = /etc/master.passwd auth_username_format = %{user | username} }
userdb passwd { driver = passwd }
userdb passwd-file { driver = passwd-file passwd_file_path = /etc/passwd }
protocol lda { mail_plugins = sieve }
service auth { executable = /usr/dovecot24/libexec/dovecot/auth user = root }
service imap-login { chroot = login client_limit = 256 executable = /usr/dovecot24/libexec/dovecot/imap-login process_limit = 128 process_min_avail = 3 restart_request_count = 1 user = dovecot
inet_listener imap { listen = 10.0.0.1, 127.0.0.1 port = 143 }
inet_listener imaps { listen = 10.0.0.1, 10.0.0.235, 10.0.0.237, 10.0.0.110, 10.0.0.249, 10.0.0.240, 127.0.0.1 port = 993 ssl = yes } }
service imap { executable = /usr/dovecot24/libexec/dovecot/imap process_limit = 512 }
ssl_server { cert_file = /path/to/ssl/certs/2026/nk.ca/crt dh_file = /usr/dovecot24/etc/dovecot/ssl/dh.pem key_file = /path/to/ssl/keys/2026/nk.ca/key ##prefer_ciphers = no }
local 10.0.0.1 { protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep imap_idle_notify_interval = 120 s imap_logout_format = bytes=%{input}/%{output} imap_max_line_length = 65536 mail_max_userip_connections = 10 mail_plugin_dir = /usr/dovecot24/lib/dovecot/imap ssl_cipher_list = TLSv1.2+AESGCM+ECDHE:TLSv1.3+AESGCM+CHACHA20 ssl_curve_list = X25519:secp384r1 ssl_min_protocol = TLSv1.2 ##verbose_ssl = yes
ssl_server {
cert_file = /path/to/ssl/certs/2026/nk.ca/crt
dh_file = /usr/dovecot24/etc/dovecot/ssl/dh.pem
key_file = /path/to/ssl/keys/2026/nk.ca/key
##prefer_ciphers = no
}} }
local 10.0.0.237 { protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep imap_idle_notify_interval = 120 s imap_logout_format = bytes=%{input}/%{output} imap_max_line_length = 65536 mail_max_userip_connections = 10 mail_plugin_dir = /usr/dovecot24/lib/dovecot/imap ssl_cipher_list = TLSv1.2+AESGCM+ECDHE:TLSv1.3+AESGCM+CHACHA20 ssl_curve_list = X25519:secp384r1 ##verbose_ssl = yes
ssl_server {
cert_file = /path/to/ssl/certs/2025/acebizventures/cert
dh_file = /usr/dovecot24/etc/dovecot/ssl/dh.pem
key_file = /path/to/ssl/keys/2022/acebizventures.com/key
}} }
local 10.0.0.110 { protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep imap_idle_notify_interval = 120 s imap_logout_format = bytes=%{input}/%{output} imap_max_line_length = 65536 mail_max_userip_connections = 10 mail_plugin_dir = /usr/dovecot24/lib/dovecot/imap ssl_cipher_list = TLSv1.2+AESGCM+ECDHE:TLSv1.3+AESGCM+CHACHA20 ssl_curve_list = X25519:secp384r1 ssl_min_protocol = TLSv1.2 ##verbose_ssl = yes
ssl_server {
cert_file = /path/to/ssl/certs/2026/pdsolutions/cert
dh_file = /usr/dovecot24/etc/dovecot/ssl/dh.pem
key_file = /path/to/ssl/keys/2022/pdsolutions.ca/key
##prefer_ciphers = no
}} }
local 10.0.0.240 { protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep imap_idle_notify_interval = 120 s imap_logout_format = bytes=%{input}/%{output} imap_max_line_length = 65536 mail_max_userip_connections = 10 mail_plugin_dir = /usr/dovecot24/lib/dovecot/imap ssl_cipher_list = TLSv1.2+AESGCM+ECDHE:TLSv1.3+AESGCM+CHACHA20 ssl_curve_list = X25519:secp384r1 ##verbose_ssl = yes
ssl_server {
cert_file = /path/to/ssl/certs/2026/cellsonic/cert
dh_file = /usr/dovecot24/etc/dovecot/ssl/dh.pem
key_file = /path/to/ssl/keys/2026/cellsonic/key
}} }
service pop3-login { chroot = login client_limit = 256 executable = /usr/dovecot24/libexec/dovecot/pop3-login process_limit = 128 process_min_avail = 4 restart_request_count = 1 user = dovecot
inet_listener pop3 { listen = 10.0.0.1 port = 110 }
inet_listener pop3s { listen = 10.0.0.1 port = 995 ssl = yes } }
service pop3 { executable = /usr/dovecot24/libexec/dovecot/pop3 process_limit = 512 }
protocol pop3 { mail_max_userip_connections = 3 pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_enable_last = yes pop3_lock_session = no pop3_logout_format = top=%{top_count}/%{top_bytes}, retr=%{retr_count}/%{retr_bytes}, del=%{deleted_count}/%{message_count}, size=%{message_bytes} pop3_no_flag_updates = yes pop3_reuse_xuidl = yes pop3_save_uidl = no pop3_uidl_format = %{uid | substr(0, 8)}%{uidvalidity | substr(0, 8)} ssl_cipher_list = TLSv1.2+AESGCM+ECDHE:TLSv1.3+AESGCM+CHACHA20 ssl_curve_list = X25519:secp384r1 ssl_min_protocol = TLSv1.2 ##verbose_ssl = yes
ssl_server { cert_file = /path/to/ssl/certs/2026/nk.ca/crt dh_file = /usr/dovecot24/etc/dovecot/ssl/dh.pem key_file = /path/to/ssl/keys/2026/nk.ca/key ##prefer_ciphers = no } }
service lmtp { executable = lmtp -L process_min_avail = 5
inet_listener lmtp { listen = 10.0.0.1 127.0.0.1 port = 24 } }
protocol lmtp { auth_username_format = %{user | lower} info_log_path = /var/log/dovecot-lmtp.log }
namespace inbox { inbox = yes type = private separator = /
mailbox Sent { special_use = \Sent auto = subscribe }
mailbox Drafts { special_use = \Drafts auto = subscribe }
mailbox Trash { special_use = \Trash auto = subscribe }
mailbox Junk { special_use = \Junk auto = subscribe } }
Warnings during conversion:
- <memory>:179: no converter for 'plugin/@1/home'
- <memory>:276: mail_plugins uses $SET:mail_plugins but adds nothing
- pruned default: ssl = 'yes'
dovecot mailing list -- dovecot@dovecot.org To unsubscribe send an email to dovecot-leave@dovecot.org
Another warning I was getting was
Aug 21 15:16:32 auth(dave,162.157.247.67,sasl:plain)<XYgkJpVZeUiinfdD>: Debug: sasl(plain): Set authid 'dave'
Aug 21 15:16:32 auth(dave,162.157.247.67,sasl:plain)<XYgkJpVZeUiinfdD>: Debug: sasl(plain): Performing plain passdb verification
Aug 21 15:16:32 auth(dave,162.157.247.67,sasl:plain)<XYgkJpVZeUiinfdD>: Debug: system_passwd: Performing passdb lookup
Aug 21 15:16:32 auth(dave,162.157.247.67,sasl:plain)<XYgkJpVZeUiinfdD>: Info: system_passwd: Failed to normalize path: Path is outside 'scheme=CRYPT username_format='
Aug 21 15:16:32 auth(dave,162.157.247.67,sasl:plain)<XYgkJpVZeUiinfdD>: Debug: system_passwd: Finished passdb lookup
Aug 21 15:16:32 auth(dave,162.157.247.67,sasl:plain)<XYgkJpVZeUiinfdD>: Debug: sasl(plain): Finished plain passdb verification (status=user-unknown)
Aug 21 15:16:32 auth(dave,162.157.247.67,sasl:plain)<XYgkJpVZeUiinfdD>: Debug: sasl(plain): Interaction failed
Aug 21 15:16:32 auth(dave,162.157.247.67,sasl:plain)<XYgkJpVZeUiinfdD>: Debug: Auth request finished
Aug 21 15:16:32 auth(dave,162.157.247.67,sasl:plain)<XYgkJpVZeUiinfdD>: Debug: delaying auth failure
from the logs.
-- Member - Liberal International This is doctor@nk.ca Ici doctor@nk.ca Yahweh, King & country!Never Satan President Republic!Beware AntiChrist rising! Look at Psalms 14 and 53 on Atheism ; 31 years in the ISP business!