Disconnect Dovecot Sessions Safely with doveadm kick

Use doveadm kick to boot a stuck, compromised or misbehaving client off your Dovecot server without restarting the whole service. You will match sessions by login name, source IP address, network range, or a user and network together. Allow about 10 minutes for a careful one-off, preview included.

This guide follows the locally installed Dovecot 2.3.21 package on Ubuntu.

Before you start

• What you need: the dovecot-core package, a shell on the Dovecot server, and administrative access to the Dovecot control socket. Run as a user that can reach it, commonly root or a suitably privileged service administrator.
• Placeholders: the examples use documentation addresses and names. Replace them with real values only after checking the current sessions.
• What it does not do: it does not delete mail, disable an account, or block an address.

1. Check the installed command and current sessions

The reference system reports version 2.3.21. Confirm the package version on your host, then list sessions before choosing a mask.

dpkg-query -W -f='${Version}\n' dovecot-core
sudo doveadm who -1

Expected output is a table with fields such as username, proto, pid and ip. If doveadm who cannot connect to the socket, stop here and fix the service or permissions. Do not guess a socket path while preparing a disconnect.

2. Preview a user's sessions

Use doveadm who with a user mask to see the likely target. In a shell, quote wildcard masks so the shell does not expand them against local filenames.

sudo doveadm who -1 '[email protected]'
sudo doveadm who -1 'jane*'

The first command targets one login name. The second is broader and can match any login name beginning with jane. who is only a preview and disconnects nothing.

3. Disconnect by login name

When the preview shows the intended accounts, pass the same mask to kick.

sudo doveadm kick '[email protected]'

For a wildcard example, ba? matches three-character login names beginning with ba, such as bar and baz. When matching connections are removed, the command prints a list headed by kicked connections from the following users:. An empty or non-matching result is not evidence that every session is gone, so repeat the preview.

4. Disconnect by address or network

Use an individual address for one observed client, or CIDR notation for a network. The command accepts both IPv4 and IPv6 addresses.

sudo doveadm who -1 '192.0.2.53'
sudo doveadm kick '192.0.2.53'

sudo doveadm who -1 '192.0.2.0/24'
sudo doveadm kick '192.0.2.0/24'

5. Narrow the action to a user and network

The safest useful form often combines a login mask with an address range. It disconnects only sessions that satisfy both conditions.

sudo doveadm who -1 'foo'
sudo doveadm kick 'foo' '192.0.2.0/24'
sudo doveadm who -1 'foo'

6. Handle the force option and alternate socket

Normally, Dovecot avoids a disconnect when multiple users from different networks share one process. The -f option enforces the disconnect in the special configuration the manpage describes: for example, an IMAP service with client_limit set to 1+n, service_count set to 0, and several users in one process.

sudo doveadm kick -f 'foo' '192.0.2.0/24'

The default control socket is /run/dovecot/anvil. If the configured base_dir puts it elsewhere, supply an absolute path:

sudo doveadm kick -a '/run/dovecot/anvil' 'foo'

Use the actual path from the running configuration. An alternative socket path does not bypass permissions or make an incompatible Dovecot instance safe to control.

7. Verify and recover

Run the same who query after every kick. If a session is still listed, check these:

• Exact match. The username and address were copied exactly.
• Proxy in the way. A proxy has not changed the visible address.
• Right instance. You used the intended Dovecot instance.

Add -v for progress output or -D for debug messages when investigating a controlled failure. Avoid leaving debug output in shared logs if it contains operational details.

sudo doveadm who -1 'foo'
sudo doveadm who -1 '192.0.2.0/24'