Dovecot don't use pam session to create home on mail delivery

Question

I have a mail server with Postfix and Dovecot, my users are mainly stored in a LDAP database and I would like dovecot/postfix to auto create the user home directory (via pam) when needed.

It's working well when a user try to log (via imap) on his new mailbox, dovecot ask pam to open a session and pam (via pam_mkhomedir) do the job.

But if a mail arrived to a valid user BEFORE this one have ever logged himself, it fails with this message :

Mar 20 15:55:45 galilee dovecot: lda(mouton): Error: User initialization failed: Namespace '': mkdir(/home/mouton/Maildir) failed: Permission denied (euid=588628(mouton) egid=588628(<unknown>) missing +w perm: /home, dir owned by 0:0 mode=0755)
Mar 20 15:55:45 galilee dovecot: lda: Fatal: Invalid user settings. Refer to server log for more information.

So how can I ask dovecot (or postfix) to open a session via pam when a mail is received on my server, in order to get the home directory created ?

Here is my dovecot configuration dovecot -n :

# 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.16 (fed8554)
# OS: Linux 4.9.0-8-amd64 x86_64 Debian 9.8 
auth_mechanisms = plain login
hostname = XXXX.XXXX.XX
mail_location = maildir:~/Maildir
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader imapflags notify
namespace inbox {
  inbox = yes
  location = 
  mailbox Drafts {
    special_use = \Drafts
  }
  mailbox Junk {
    special_use = \Junk
  }
  mailbox Sent {
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Spam {
    auto = subscribe
    special_use = \Junk
  }
  mailbox Trash {
    special_use = \Trash
  }
  prefix = 
}
passdb {
  args = failure_show_msg=yes session=yes dovecot
  driver = pam
}
plugin {
  sieve = file:~/sieve;active=~/.dovecot.sieve
  sieve_before = /etc/dovecot/sieve/spamfilter.sieve
  sieve_editheader_forbid_add = X-Verified
  sieve_editheader_forbid_delete = X-Verified X-Seen
  sieve_editheader_max_header_size = 1k
  sieve_extensions = +notify +imapflags +editheader
}
postmaster_address = [email protected]
protocols = " imap lmtp sieve pop3 sieve"
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0666
    user = postfix
  }
}
service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    group = postfix
    mode = 0600
    user = postfix
  }
}
service managesieve-login {
  inet_listener sieve {
    port = 2000
  }
  inet_listener sieve_deprecated {
    port = 2001
  }
  process_min_avail = 0
  service_count = 1
  vsz_limit = 64 M
}
service managesieve {
  process_limit = 1024
}
ssl = required
ssl_cert = </etc/letsencrypt/live/galilee.eedf.fr/fullchain.pem
ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
ssl_dh_parameters_length = 2048
ssl_key =  # hidden, use -P to show it
ssl_prefer_server_ciphers = yes
ssl_require_crl = no
userdb {
  driver = passwd
}
protocol lmtp {
  mail_plugins = " sieve"
}
protocol lda {
  mail_plugins = " sieve"
}
protocol imap {
  mail_max_userip_connections = 150
}

PS : I use spamassassin, but it don't think it causes any problem with this issue.

Answer 1

I think you have to config dovecot to operate with a single unix vmail user. That should resolve this problem. First create a user e.g. vmail:

service lmtp {
 unix_listener /var/spool/postfix/private/dovecot-lmtp {
   group = postfix
   mode = 0600
   user = postfix
  }
  user = vmail
}

mail_uid = 1000   # uid of vmail user
mail_gid = 1000   # gid of vmail user

mail_home = /home/vmail/%d/%n