Re: Bug report: doveadm kick does not kick proxy sessions

--===============7282233620027471120==
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_EBF9F63C-2A7F-4F05-8325-D36F9DCB53F7"


--Apple-Mail=_EBF9F63C-2A7F-4F05-8325-D36F9DCB53F7
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

On 6. Jul 2026, at 11.47, Patrick Cernko <[email protected]> =
wrote:
>=20
> Hi Timo,
>=20
> On 2026-07-05 18:27:51, Timo Sirainen wrote:
>> On 1. Jul 2026, at 15.11, Patrick Cernko via dovecot =
<[email protected]> wrote:
>>>=20
>>> Hi Dovecot Devs,
>>>=20
>>> I'm currently setting up Dovecot 2.4 as frontend proxy to our =
backends. The frontends simply use an LDAP attribute of the user to =
connect to the assigned IMAP backend server. That works fine so far.
>>>=20
>>> According to the documentation =
<https://doc.dovecot.org/2.4.4/core/man/doveadm- kick.1.html>, I should =
be able to disconnect a user with
>>>=20
>>> doveadm kick USERNAME
>>>=20
>>> or all sessions to a specific backend with
>>>=20
>>> doveadm kick -h BACKEND_IP
>>>=20
>>> or simply ALL sessions with
>>>=20
>>> doveadm kick '*'
>>>=20
>>> However the command reports the expected amount of connections =
kicked and exitcode 0, but all sessions stay connected. I also tried =
'doveadm proxy kick ...' but as the the corresponding documentation =
states, this is only an alias for 'doveadm kick ...' and thus shows the =
same behavior.
>> Looks like kicking proxied connections works only in login processes' =
"high performance mode": =
https://doc.dovecot.org/2.4.4/core/config/login_processes.html#high-perfor=
mance-mode <https://doc.dovecot.org/2.4.4/core/ =
config/login_processes.html#high-performance-mode =
<https://doc.dovecot.org/2.4.4/core/%20config/login_processes.html#high-pe=
rformance-mode>>
>> I'll get it fixed for the default "high security mode" as well, =
hopefully for v2.4.5 still.
>=20
> thank you!
>=20
> In the meantime, I have tried to debug and fix this myself. Maybe my =
findings help you:
> When handling proxy logins, the `current_user` field of =
`master_service` is not set. As a consequence, =
`sig_service_kick_user_match()` will return 0 which leads to ignoring =
the KILL-USER command from anvil. I tried to fix this by setting =
`master_service_set_current_user(master_service, client->virtual_user)` =
in login-proxy.c, similar to mail-storage-service.c, see my attached =
patched. I can provide this fix also as a pull request via Github, if =
you like!

Ah, I didn't think you were in a hurry to get a fix with the workaround =
being available :) But yes, I've a pretty similar fix waiting in our =
internal gitlab. Will be public in github after internal review.=

--Apple-Mail=_EBF9F63C-2A7F-4F05-8325-D36F9DCB53F7
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"

   On 6. Jul 2026, at 11.47, Patrick Cernko <[email protected]> wrote:

     Hi Timo,

     On 2026-07-05 18:27:51, Timo Sirainen wrote:

       On 1. Jul 2026, at 15.11, Patrick Cernko via dovecot
       <[email protected]> wrote:

         Hi Dovecot Devs,

         I'm currently setting up Dovecot 2.4 as frontend proxy to our
         backends. The frontends simply use an LDAP attribute of the user to
         connect to the assigned IMAP backend server. That works fine so far.

         According to the documentation
         <https://doc.dovecot.org/2.4.4/core/man/doveadm- kick.1.html>, I
         should be able to disconnect a user with

         doveadm kick USERNAME

         or all sessions to a specific backend with

         doveadm kick -h BACKEND_IP

         or simply ALL sessions with

         doveadm kick '*'

         However the command reports the expected amount of connections
         kicked and exitcode 0, but all sessions stay connected. I also tried
         'doveadm proxy kick ...' but as the the corresponding documentation
         states, this is only an alias for 'doveadm kick ...' and thus shows
         the same behavior.

       Looks like kicking proxied connections works only in login processes'
       "high performance
       mode": [1]https://doc.dovecot.org/2.4.4/core/config/login_processes.html#high-performance-mode
       <[2]https://doc.dovecot.org/2.4.4/core/
       config/login_processes.html#high-performance-mode>
       I'll get it fixed for the default "high security mode" as well,
       hopefully for v2.4.5 still.

     thank you!

     In the meantime, I have tried to debug and fix this myself. Maybe my
     findings help you:
     When handling proxy logins, the `current_user` field of `master_service`
     is not set. As a consequence, `sig_service_kick_user_match()` will
     return 0 which leads to ignoring the KILL-USER command from anvil. I
     tried to fix this by setting
     `master_service_set_current_user(master_service, client->virtual_user)`
     in login-proxy.c, similar to mail-storage-service.c, see my attached
     patched. I can provide this fix also as a pull request via Github, if
     you like!

   Ah, I didn't think you were in a hurry to get a fix with the workaround
   being available :) But yes, I've a pretty similar fix waiting in our
   internal gitlab. Will be public in github after internal review.

References

   Visible links
   1. https://doc.dovecot.org/2.4.4/core/config/
   2. https://doc.dovecot.org/2.4.4/core/%20config/login_processes.html#high-performance-mode

--Apple-Mail=_EBF9F63C-2A7F-4F05-8325-D36F9DCB53F7--

--===============7282233620027471120==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
dovecot mailing list -- [email protected]
To unsubscribe send an email to [email protected]

--===============7282233620027471120==--