.TH "DOVEADM-KICK" "1" "May 2026" "e5ac02a" "Dovecot"
.SH "NAME"
\fBdoveadm-kick\fR - Disconnect users by user name and/or IP address
.SH "SYNOPSIS"
.P
\fBdoveadm\fR \[lB]\fIGLOBAL OPTIONS\fR\[rB] \fBkick\fR \[lB]\fB-a\fR \fIanvil_socket_path\fR\[rB] \[lB]\fB-f\fR \fIpassdb_field\fR\[rB] \[lB]\fB-h\fR \fIdest_host\fR\[rB] \fIuser_mask\fR
.P
\fBdoveadm\fR \[lB]\fIGLOBAL OPTIONS\fR\[rB] \fBkick\fR \[lB]\fB-a\fR \fIanvil_socket_path\fR\[rB] \[lB]\fB-f\fR \fIpassdb_field\fR\[rB] \[lB]\fB-h\fR \fIdest_host\fR\[rB] \fIip\fR \[lB]\fB/\fR \fIbits\fR\[rB]
.P
\fBdoveadm\fR \[lB]\fIGLOBAL OPTIONS\fR\[rB] \fBkick\fR \[lB]\fB-a\fR \fIanvil_socket_path\fR\[rB] \[lB]\fB-f\fR \fIpassdb_field\fR\[rB] \[lB]\fB-h\fR \fIdest_host\fR\[rB] \fIuser_mask\fR \fIip\fR \[lB]\fB/\fR \fIbits\fR\[rB]
.P
\fBdoveadm\fR \[lB]\fIGLOBAL OPTIONS\fR\[rB] \fBkick\fR \[lB]\fB-a\fR \fIanvil_socket_path\fR\[rB] \[lB]\fB-f\fR \fIpassdb_field\fR\[rB] \fB-h\fR \fIdest_host\fR
.SH "DESCRIPTION"
.P
\fBdoveadm\fR's \fBkick\fR command is used to disconnect users by \fIuser_mask\fR and/or the \fIip\fR address, from which they are connected.
.P
In the first form, all users, whose login name matches the \fIuser_mask\fR argument, will be disconnected.
.P
In the second form, all users, connected from the given IP address or network range, will be disconnected.
.P
In the third form, only users connected from the given IP address or networks range and a matching login name will be disconnected.
.P
In the last form, all proxy connections to the given destination host are disconnected.
.SH "GLOBAL OPTIONS"
.P
Global doveadm(1) \fIoptions\fR:
.P
\fB-D\fR
.RS 0
.RS 4
.P
Enables \fIverbosity\fR and debug messages.
.RE 0

.RE 0

.P
\fB-O\fR
.RS 0
.RS 4
.P
Do not read any config file, just use defaults. The \fBdovecot_storage_version\fR setting defaults to the latest version, but can be overridden with \fB-o\fR.
.RE 0

.RE 0

.P
\fB-k\fR
.RS 0
.RS 4
.P
Preserve entire environment for doveadm, not just \fBimport_environment\fR setting.
.RE 0

.RE 0

.P
\fB-v\fR
.RS 0
.RS 4
.P
Enables verbosity, including progress counter.
.RE 0

.RE 0

.P
\fB-i\fR \fIinstance-name\fR
.RS 0
.RS 4
.P
If using multiple Dovecot instances, choose the config file based on this instance name.
.P
See \fBinstance_name\fR setting for more information.
.RE 0

.RE 0

.P
\fB-c\fR \fIconfig-file\fR
.RS 0
.RS 4
.P
Read configuration from the given \fIconfig-file\fR. By default it first reads config socket, and then falls back to \fI/etc/dovecot/dovecot.conf\fR. You can also point this to config socket of some instance running compatible version.
.RE 0

.RE 0

.P
\fB-o\fR \fIsetting\fR\fB=\fR\fIvalue\fR
.RS 0
.RS 4
.P
Overrides the configuration \fIsetting\fR from \fI/etc/dovecot/dovecot.conf\fR and from the userdb with the given \fIvalue\fR. In order to override multiple settings, the \fB-o\fR option may be specified multiple times.
.RE 0

.RE 0

.SH "OPTIONS"
.P
\fB-a\fR \fIanvil_socket_path\fR
.RS 0
.RS 4
.P
This option is used to specify an absolute path to an alternative UNIX domain socket.
.P
By default doveadm(1) will use the socket \fI/rundir/anvil\fR. The socket may be located in another directory, when the default \fIbase_dir\fR setting was overridden in \fI/etc/dovecot/dovecot.conf\fR.
.RE 0

.RE 0

.P
\fB-f\fR \fIpassdb_field\fR
.RS 0
.RS 4
.P
Alternative username field to use for kicking, as returned by passdb. Only the passdb fields beginning with the \fIuser_\fR prefix are tracked.
.RE 0

.RE 0

.P
\fB-h\fR \fIdest_host\fR
.RS 0
.RS 4
.P
Disconnect proxy connections to the given \fIdest_host\fR.
.RE 0

.RE 0

.SH "ARGUMENTS"
.P
\fIip\fR \[lB]/\fIbits\fR\[rB]
.RS 0
.RS 4
.P
\fIip\fR or \fIip\fR \fB/\fR \fIbits\fR is the host or network, from which the users are connected.
.RE 0

.RE 0

.P
\fIuser_mask\fR
.RS 0
.RS 4
.P
Is a user's login name, or the alternative username (user_* field) if the \fB-f\fR parameter is used. Depending on the configuration, a login name may be for example \fBjane\fR or \fB\fI\(lajohn@example.com\(ra\fB\fR. It's also possible to use '*\fB\fB' and '\fB?\fR' wildcards (e.g. -u *@example.org).
.RE 0

.RE 0

.SH "EXAMPLE"
.P
If you don't want to disconnect all users at once, you can check who's currently logged in. The first example demonstrates how to disconnect all users whose login name is 3 characters long and begins with \fBba\fR:
.P
.RS 2
.nf
doveadm who -1 ja\[rs]*
.fi
.RE
.P
.RS 2
.nf
username                      service pid ip
jane                          imap   8192 ::1
jano                          imap   8196 ::2
james                         imap   8203 2001:db8:543:2::1
.fi
.RE
.P
.RS 2
.nf
doveadm kick jan?
# The connections for jane and jano are kicked.
.fi
.RE
.P
The next example shows how to kick user foo's connections from 192.0.2.*:
.P
.RS 2
.nf
doveadm who -1 foo
.fi
.RE
.P
.RS 2
.nf
username                     service pid ip
foo                          imap   8135 fd95:4eed:38ba::25
foo                          imap   9112 192.0.2.53
foo                          imap   8216 192.0.2.111
.fi
.RE
.P
.RS 2
.nf
doveadm kick foo 192.0.2.0/24
doveadm who f\[rs]*
.fi
.RE
.P
.RS 2
.nf
username                  # service (pids) (ips)
foo                       1 imap    (8135) (fd95:4eed:38ba::25)
.fi
.RE
.SH "REPORTING BUGS"
.P
Report bugs, including \fIdoveconf -n\fR output, to the Dovecot Mailing List \fI\(ladovecot@dovecot.org\(ra\fR. Information about reporting bugs is available at: \fI\(lahttps://dovecot.org/bugreport.html\(ra\fR
.SH "SEE ALSO"
.P
doveadm(1)