dovecot - Sep 2017 - pam authentication

Hello all

I use debian 9 with dovecot 2.x: real system users and virtual users: 
almost all works perfectly ;)

Virtual users can connect via imap and pop using name + domain name: 
user00 at domain1.org, etc.

pam (real system users) users can connect via imap and pop ONLY without 
domain name

It's a problem with pam authentication because linux make users 
authentication with only username (and not with also domain name) but 
I'd like user full email like test00 at realdomain.org

cat /etc/dovecot/conf.d/auth-passwdfile.conf.ext

passdb {
   driver = passwd-file
   args = scheme=SHA256 username_format=%u /etc/dovecot/users
}

userdb {
   driver = passwd-file
   args = scheme=SHA256 username_format=%u /etc/dovecot/users
}

cat /etc/dovecot/conf.d/auth-system.conf.ext

passdb {
   driver = pam
}

userdb {
   driver = passwd
}

inside /etc/dovecot/conf.d/10-auth.conf
[...]
#auth_username_format = %n

is commented because I've multiple domains

cat /var/log/dovecot.debug

Sep 05 01:49:51 auth: Debug: Read auth token secret from 
/var/run/dovecot/auth-token-secret.dat
Sep 05 01:49:51 auth: Debug: passwd-file /etc/dovecot/users: Read 4 
users in 0 secs
Sep 05 01:49:51 auth: Debug: auth client connected (pid=23412)
Sep 05 01:49:51 auth: Debug: client in: AUTH    1       PLAIN   
service=imap    secured session=hjdhgfghhg        lip=192.168.1.100      
  rip=192.168.1.100       lport=143       rport=39356     
resp=hsdfhsfddfjk
jklsdfkljkdlskfljsdkjlfds== (previous base64 data may contain sensitive 
data)
Sep 05 01:49:51 auth-worker(23414): Debug: Loading modules from 
directory: /usr/lib/dovecot/modules/auth
Sep 05 01:49:51 auth-worker(23414): Debug: passwd-file 
/etc/dovecot/users: Read 4 users in 0 secs
Sep 05 01:49:51 auth-worker(23414): Debug: 
pam(test at realdomain.org,192.168.1.100,<PitAxGVYvJnAqAFk>): lookup 
service=dovecot
Sep 05 01:49:51 auth-worker(23414): Debug: 
pam(test at realdomain.org,192.168.1.100,<PitAxGVYvJnAqAFk>): #1/1 style=1
msg=Password:
Sep 05 01:49:53 auth: Debug: 
passwd-file(test at realdomain.org,192.168.1.100,<PitAxGVYvJnAqAFk>): 
lookup: user=test at realdomain.org file=/etc/dovecot/users
Sep 05 01:49:55 auth: Debug: client passdb out: FAIL    1       
user=test at realdomain.com
Sep 05 01:51:15 auth: Debug: Loading modules from directory: 
/usr/lib/dovecot/modules/auth
Sep 05 01:51:15 auth: Debug: Read auth token secret from 
/var/run/dovecot/auth-token-secret.dat
Sep 05 01:51:15 auth: Debug: passwd-file /etc/dovecot/users: Read 4 
users in 0 secs
Sep 05 01:51:15 auth: Debug: auth client connected (pid=23461)
Sep 05 01:51:26 auth: Debug: client in: AUTH    1       PLAIN   
service=imap    secured session=ycnxyWVYQYokInmi        lip=192.168.0.2 
rip=36.34.121.162       lport=993       rport=35393
Sep 05 0

any idea?

thanks for help!

Pol
-- 
Pol

On 05.09.2017 10:52, Pol Hallen wrote:
> Hello all
>
> I use debian 9 with dovecot 2.x: real system users and virtual users:
> almost all works perfectly ;)
>
> Virtual users can connect via imap and pop using name + domain name:
> user00 at domain1.org, etc.
>
> pam (real system users) users can connect via imap and pop ONLY
> without domain name
>
> It's a problem with pam authentication because linux make users
> authentication with only username (and not with also domain name) but
> I'd like user full email like test00 at realdomain.org
>
> cat /etc/dovecot/conf.d/auth-passwdfile.conf.ext
>
> passdb {
>   driver = passwd-file
>   args = scheme=SHA256 username_format=%u /etc/dovecot/users
> }
>
> userdb {
>   driver = passwd-file
>   args = scheme=SHA256 username_format=%u /etc/dovecot/users
> }
>
> cat /etc/dovecot/conf.d/auth-system.conf.ext
>
> passdb {
>   driver = pam
> }
>
> userdb {
>   driver = passwd
> }
>
passdb {
  driver = pam
  args = username_format=%n
}

also you probably want to consider using driver=passwd instead, if you
really don't need pam due to some special plugins.

Aki

Hello, thanks for your reply

I already tried with:

username_format=%n or auth_username_format=%n but I've same problem

Pol
> passdb {
> driver = pam
> args = username_format=%n
> }
> 
> also you probably want to consider using driver=passwd instead, if you
> really don't need pam due to some special plugins.
> 
> Aki

-- 
Pol