Resolved. For others, this is the simple solution which works for me:
/etc/dovecot.conf:
auth default {
userdb passwd-file {
args = /etc/passwd
}
passdb passwd-file {
args = scheme="MD5-CRYPT" /etc/dovecot.passwd
}
}
/etc/dovecot.passwd:
bob at vhost.com:$1$yAOjs09l$...::::::userdb_user=vabc_bob
(the encrypted password "$1$yAOjs09l$..." comes from /etc/shadow)
/etc/passwd:
vabc_bob:x:20838:2362:bob:/home/mailusers/vabc_bob:/sbin/nologin
"abc" could also be the domain ("vhost"), but this might be
too large for really long domain names. So we rather use a short unique prefix
for each domain.
Cheers
Henry
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.5 (GNU/Linux)
mOIESXlwDRECAOycneJPOwSkETRkjJZdArag8V2rKOR2IUwlDOydIZXv/ITDlWDU
dookzEdWh7Ektf1Jlh+YbPNEGoPpQunL8O8AoJbWmNkpoX7jP0Sw/5rDN2eKGHR7
Af9mxTqQ/j3C5LkrTRo9iCTt1TxoqPi6R/w0KkIAuTXBq6j+vIFJcOFgABlMQoXs
V2crh1BUCmXVsV1puRJsLWKbAf4uL0V+N8WF4rvWHmJiYjgDn6exv3XHS0F6NhRz
n1KVnV0XDWMDq/B/tmj4L2JYxEzWzeNulC5yQBOdx/dLU12XtCNIZW5yeSAoemVu
LmNvLnphKSA8aGVucnlAemVuLmNvLnphPohgBBMRAgAgBQJJeXANAhsjBgsJCAcD
AgQVAggDBBYCAwECHgECF4AACgkQCHhhdg2iQafVGACdEMtEuUGIW2XJyn9Fig7n
sX4qzb4An0PGStBZvAP2qtzYP3SGlzsllzLjuI0ESXlwDRACAMsi4nl8/Yar2m9F
ex4dFDgWylLgScQrEhhb2xN0Upcglm60nHQD7c1rP+63Iu+lU0eWvyr8o3JTCN4y
PpoGMOMAAwUCAIUnLDMW/tz+qsYaOPyoh7HdAYqcrvVar7t+eKpihNBqfP4CT2Py
aRVMN6cSJj9NKZDW6b0QQSCGgN7PpzrLqf6ISQQYEQIACQUCSXlwDQIbDAAKCRAI
eGF2DaJBpxeiAJ9cNiuaftSoWke75RT1pn7qoibFfgCdHl6BgP9f450/oziDwaMM
w49UeHQ=qgmL
-----END PGP PUBLIC KEY BLOCK-----