Resolved. For others, this is the simple solution which works for me:

/etc/dovecot.conf: auth default {

userdb passwd-file {
    args = /etc/passwd
}

passdb passwd-file {
    args = scheme="MD5-CRYPT" /etc/dovecot.passwd
}

}

/etc/dovecot.passwd: bob@vhost.com:$1$yAOjs09l$...::::::userdb_user=vabc_bob (the encrypted password "$1$yAOjs09l$..." comes from /etc/shadow)

/etc/passwd: vabc_bob:x:20838:2362:bob:/home/mailusers/vabc_bob:/sbin/nologin

"abc" could also be the domain ("vhost"), but this might be too large for really long domain names. So we rather use a short unique prefix for each domain.

Cheers Henry

-----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.5 (GNU/Linux)

mOIESXlwDRECAOycneJPOwSkETRkjJZdArag8V2rKOR2IUwlDOydIZXv/ITDlWDU dookzEdWh7Ektf1Jlh+YbPNEGoPpQunL8O8AoJbWmNkpoX7jP0Sw/5rDN2eKGHR7 Af9mxTqQ/j3C5LkrTRo9iCTt1TxoqPi6R/w0KkIAuTXBq6j+vIFJcOFgABlMQoXs V2crh1BUCmXVsV1puRJsLWKbAf4uL0V+N8WF4rvWHmJiYjgDn6exv3XHS0F6NhRz n1KVnV0XDWMDq/B/tmj4L2JYxEzWzeNulC5yQBOdx/dLU12XtCNIZW5yeSAoemVu LmNvLnphKSA8aGVucnlAemVuLmNvLnphPohgBBMRAgAgBQJJeXANAhsjBgsJCAcD AgQVAggDBBYCAwECHgECF4AACgkQCHhhdg2iQafVGACdEMtEuUGIW2XJyn9Fig7n sX4qzb4An0PGStBZvAP2qtzYP3SGlzsllzLjuI0ESXlwDRACAMsi4nl8/Yar2m9F ex4dFDgWylLgScQrEhhb2xN0Upcglm60nHQD7c1rP+63Iu+lU0eWvyr8o3JTCN4y PpoGMOMAAwUCAIUnLDMW/tz+qsYaOPyoh7HdAYqcrvVar7t+eKpihNBqfP4CT2Py aRVMN6cSJj9NKZDW6b0QQSCGgN7PpzrLqf6ISQQYEQIACQUCSXlwDQIbDAAKCRAI eGF2DaJBpxeiAJ9cNiuaftSoWke75RT1pn7qoibFfgCdHl6BgP9f450/oziDwaMM w49UeHQ= =qgmL -----END PGP PUBLIC KEY BLOCK-----