Drei gängige Auth-Backends

1. passwd-file (kleine, statische Installationen):

/etc/dovecot/users:

alice@example.com:{SHA512-CRYPT}$6$abc...:5000:5000::/var/mail/vhosts/example.com/alice

conf.d/10-auth.conf:

passdb {
  driver = passwd-file
  args = scheme=SHA512-CRYPT username_format=%u /etc/dovecot/users
}
userdb {
  driver = passwd-file
  args = username_format=%u /etc/dovecot/users
}

2. SQL (die meisten Hosting-Setups):

conf.d/auth-sql.conf.ext:

passdb { driver = sql; args = /etc/dovecot/dovecot-sql.conf.ext }
userdb { driver = sql; args = /etc/dovecot/dovecot-sql.conf.ext }

/etc/dovecot/dovecot-sql.conf.ext:

driver = mysql
connect = host=127.0.0.1 dbname=mail user=mail password=secret
default_pass_scheme = SHA512-CRYPT
password_query = SELECT email AS user, password FROM users WHERE email='%u' AND active=1
user_query = SELECT '/var/mail/vhosts/%d/%n' AS home, 5000 AS uid, 5000 AS gid, \
  CONCAT('*:bytes=', quota_bytes) AS quota_rule FROM users WHERE email='%u'

3. LDAP (Unternehmen): conf.d/auth-ldap.conf.ext mit hosts, base, pass_filter, user_filter. Funktioniert hervorragend mit FreeIPA, Samba AD, OpenLDAP.

🎯 Hashen Sie Passwörter immer mit SHA512-CRYPT oder ARGON2I. Speichern Sie niemals Klartext, MD5 oder ungesalzenes SHA-1.