Trois backends d'authentification courants

1. passwd-file (petits déploiements statiques) :

/etc/dovecot/users :

alice@example.com:{SHA512-CRYPT}$6$abc...:5000:5000::/var/mail/vhosts/example.com/alice

conf.d/10-auth.conf :

passdb {
  driver = passwd-file
  args = scheme=SHA512-CRYPT username_format=%u /etc/dovecot/users
}
userdb {
  driver = passwd-file
  args = username_format=%u /etc/dovecot/users
}

2. SQL (la plupart des hébergements) :

conf.d/auth-sql.conf.ext :

passdb { driver = sql; args = /etc/dovecot/dovecot-sql.conf.ext }
userdb { driver = sql; args = /etc/dovecot/dovecot-sql.conf.ext }

/etc/dovecot/dovecot-sql.conf.ext :

driver = mysql
connect = host=127.0.0.1 dbname=mail user=mail password=secret
default_pass_scheme = SHA512-CRYPT
password_query = SELECT email AS user, password FROM users WHERE email='%u' AND active=1
user_query = SELECT '/var/mail/vhosts/%d/%n' AS home, 5000 AS uid, 5000 AS gid, \
  CONCAT('*:bytes=', quota_bytes) AS quota_rule FROM users WHERE email='%u'

3. LDAP (entreprise) : conf.d/auth-ldap.conf.ext avec hosts, base, pass_filter, user_filter. Fonctionne très bien avec FreeIPA, Samba AD et OpenLDAP.

🎯 Hachez toujours les mots de passe en SHA512-CRYPT ou ARGON2I. Ne stockez jamais de mots de passe en clair, en MD5 ou en SHA-1 sans sel.