Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Postfix/Dovecot setup on my server and I use Webmin/Virtualmin for management. Receiving emails works fine, and users are able to authenticate when accessing via IMAP. I am having problems with setting up auth on SMTP send.

Authentication technically works even when sending emails, but either Postfix tries to auth the wrong user, or Dovecot reads Postfix's virtual map wrong. This is what I get in the logs.


Feb  5 11:58:27 host dovecot: auth(default): new auth connection: pid=24358
Feb  5 11:58:27 host dovecot: auth(default): new auth connection: pid=24359
Feb  5 11:58:27 host dovecot: auth(default): client in: AUTH    1       PLAIN  service=IMAP     secured lip=::ffff:       rip=::ffff:
Feb  5 11:58:27 host dovecot: auth(default): pam(username@ivar.rs,::ffff: lookup service=dovecot
Feb  5 11:58:29 host dovecot: auth(default): pam(username@ivar.rs,::ffff: pam_authenticate() failed: User not known to the underlying authentication module
Feb  5 11:58:30 host dovecot: auth(default): client out: FAIL   1       user=username@ivar.rs
Feb  5 11:58:30 host dovecot: imap-login: Disconnected: rip=::ffff:, lip=::ffff:
Feb  5 11:58:31 host dovecot: auth(default): new auth connection: pid=24361
Feb  5 12:01:06 host dovecot: imap-login: Disconnected: Inactivity: user=<username@ivar.rs>, method=PLAIN, rip=::ffff:, lip=::ffff:, TLS

As you can see, it tries to auth as "username@ivar.rs", while the correct user account would be "username.ivarrs". These are mapped in a Postfix virtual map file.

I tried using dovecot auth translation to rewrite "@" as ".", but I was unable to remove "." from the domain.

Do you have any ideas how to solve this problem? Is there any way to force Postfix/Dovecot to use the correct username instead of the email address?

Here are the config files.

postconf -n:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
debug_peer_level = 2
html_directory = no
inet_protocols = ipv4
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
newaliases_path = /usr/bin/newaliases.postfix
readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES
sample_directory = /usr/share/doc/postfix-2.3.3/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_tls_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/postfix/postfix.pem
smtpd_tls_key_file = /etc/postfix/postfix.key
unknown_local_recipient_reject_code = 550
virtual_alias_maps = hash:/etc/postfix/virtual

dovecot -n:

# 1.0.7: /etc/dovecot.conf
protocols: imap pop3
disable_plaintext_auth: yes
login_dir: /var/run/dovecot/login
login_executable(default): /usr/libexec/dovecot/imap-login
login_executable(imap): /usr/libexec/dovecot/imap-login
login_executable(pop3): /usr/libexec/dovecot/pop3-login
mail_executable(default): /usr/libexec/dovecot/imap
mail_executable(imap): /usr/libexec/dovecot/imap
mail_executable(pop3): /usr/libexec/dovecot/pop3
mail_plugin_dir(default): /usr/lib64/dovecot/imap
mail_plugin_dir(imap): /usr/lib64/dovecot/imap
mail_plugin_dir(pop3): /usr/lib64/dovecot/pop3
auth default:
  mechanisms: plain login
  debug: yes
  debug_passwords: yes
    driver: pam
    driver: passwd
share|improve this question
Does it work when you configure the client to send the correct username? –  mgorven Feb 5 '13 at 19:02
Nope. The client already sends the correct username, but that gets transformed into user@domain somewhere along the way when trying to send mails. –  Damir Feb 5 '13 at 20:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.