Roundcube+Dovecot 2.4+ CRAM-MD5 auth + post-login script

[swfan]

Use: roundcube 1.6.13 + php 8.3.6, Dovecot 2.4.2. Users authenticated use CRAM-MD5 encrypted passwords. (for plain passwords - all ok). dovecot running script after succesfull user login, roundcube cann't login. if disable postlogin procedure in dovecot - roundcube sucessfull logon.

Imap debug:

Code Select Expand

[16-Feb-2026 10:59:10 +0000]: <sjjbdalv> [D991] S: * OK [CAPABILITY IMAP4rev1 LO
GIN-REFERRALS ID ENABLE IDLE SASL-IR LITERAL+ STARTTLS LOGINDISABLED AUTH=DIGEST
-MD5 AUTH=CRAM-MD5 AUTH=SCRAM-SHA-1 AUTH=SCRAM-SHA-256] Dovecot ready.
[16-Feb-2026 10:59:10 +0000]: <sjjbdalv> [D991] C: A0001 AUTHENTICATE CRAM-MD5
[16-Feb-2026 10:59:10 +0000]: <sjjbdalv> [D991] S: + PDcxNzgxNzEyODgwNzUzNDIuMTc
3MTIzOTU1MEBzb2xvPg==
[16-Feb-2026 10:59:10 +0000]: <sjjbdalv> [D991] C: ****** [58]
[16-Feb-2026 10:59:10 +0000]: <sjjbdalv> [D991] S: UPDATE 1


Userlogins:

Code Select Expand

[16-Feb-2026 10:59:11 +0000]: <sjjbdalv> Failed login for ***@***.** from 10.5
.16.48 in session sjjbdalvqo2c3bal (error: -2)
Dovecot has no errors in logs

Dovecot config:

Code Select Expand

service imap {
  executable = imap imap-postlogin
}
service imap-postlogin {
    executable = script-login /etc/dovecot/scripts/lastlog
    user = $SET:default_internal_user
    unix_listener imap-postlogin {
        mode = 0660
        user = vmail
        group = vmail
    }
}

lastlogin script:

Code Select Expand

#!/bin/sh

DBUSER=dovecot
DBPASS=*****
HOST=*****
DB=mailserver

QUERY="update users set lastlogin=localtimestamp(0), remote_ip='$IP' where email='$USER'"

psql postgresql://$DBUSER:$DBPASS@$HOST/$DB --command="$QUERY"

exec "$@"

Thuderbird worked correctly without errors.

Please help.

[SKaero]

Enable imap_debug in the Roundcube config and then look at the log to see what the mail server is returning to Roundcube.

[swfan]

Enable imap_debug in the Roundcube config and then look at the log to see what the mail server is returning to Roundcube.

Look first code in my message.

[SKaero]

I don't think my request was clear, I would like to see the log from a working login and and failed login. Looking at what was posted I don't know what the "UPDATE 1" is there for and my guess is that is what is causing the issue but I would like to confirm with a comparison to a successful login.

[swfan]

I don't think my request was clear, I would like to see the log from a working login and and failed login. Looking at what was posted I don't know what the "UPDATE 1" is there for and my guess is that is what is causing the issue but I would like to confirm with a comparison to a successful login.

ok. log for succesfull login

Code Select Expand

[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] S: * OK [CAPABILITY IMAP4rev1 LO
GIN-REFERRALS ID ENABLE IDLE SASL-IR LITERAL+ STARTTLS LOGINDISABLED AUTH=DIGEST
-MD5 AUTH=CRAM-MD5 AUTH=SCRAM-SHA-1 AUTH=SCRAM-SHA-256] Dovecot ready.
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] C: A0001 AUTHENTICATE CRAM-MD5
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] S: + PDY4NzA5NTI1Mjc5MDc4NjcuMTc
3MTMwNzU2NUBzb2xvPg==
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] C: ****** [58]
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] S: A0001 OK [CAPABILITY IMAP4rev
1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THR
EAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDRE
N NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SE
ARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE REPLACE SNIPPET=FUZZY PREV
IEW=FUZZY PREVIEW SPECIAL-USE STATUS=SIZE SAVEDATE COMPRESS=DEFLATE INPROGRESS N
OTIFY LITERAL+] Logged in
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] C: A0002 ID ("name" "Roundcube"
"version" "1.6.13" "php" "8.3.6" "os" "Linux" "command" "/roundcube/?_task=login
")
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] S: * ID ("name" "Dovecot")
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] S: A0002 OK ID completed (0.001
+ 0.000 secs).
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] C: A0003 NAMESPACE
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] S: * NAMESPACE (("" "/")) NIL NI
L
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] S: A0003 OK Namespace completed
(0.001 + 0.000 secs).
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] C: A0004 LIST (SPECIAL-USE) "" "
*" RETURN (SUBSCRIBED)
.....

in dovecot config disabled this:

Code Select Expand

service imap {
#  executable = imap imap-postlogin
}


[SKaero]

So that confirms that the issue is the "UPDATE 1" that the mail server is sending Roundcube. Looking at the script your running I think the "UPDATE 1" is the output of the psql command, try adding --quiet to that command to suppress the output if that doesn't work try piping the output to /dev/null

[swfan]

So that confirms that the issue is the "UPDATE 1" that the mail server is sending Roundcube. Looking at the script your running I think the "UPDATE 1" is the output of the psql command, try adding --quiet to that command to suppress the output if that doesn't work try piping the output to /dev/null

Thank you very much, it worked. Logon script change to:

Code Select Expand

psql postgresql://$DBUSER:$DBPASS@$HOST/$DB --command="$QUERY" >/dev/null