# Executable location.
#login_executable = /usr/libexec/dovecot/imap-login
-# User to use for the login process. The user must belong to a group where
-# only it has access, it's used to control access for authentication process
-# named sockets.
+# User to use for the login process. Create a completely new user for this,
+# and don't use it anywhere else. The user must also belong to a group where
+# only it has access, it's used to control access for authentication process.
#login_user = dovecot
# Set max. process size in megabytes. If you don't use
# Set max. process size in megabytes.
#auth_process_size = 256
-# User to use for the process. Only shadow and pam authentication requires
-# roots, so use something else if possible.
+# User to use for the process. This user needs access to only user and
+# password databases, nothing else. Only shadow and pam authentication
+# requires roots, so use something else if possible.
auth_user = root
# Directory where to chroot the process. Most authentication backends don't