[Dovecot] POP3 locking

[Adrian Overbury]

I'm trying to understand what dovecot's behavior will be in a given 
scenario to see if it will work as a (hopefully better) replacement for 
the home-grown pop3 server we currently use.

User A is on a slow dialup connection, and uses, oh, let's say Outlook, 
since that's where most of our problems seem to spring from.  User A 
uses outlook to download his mail over pop3.  Half way through 
downloading a particularly large message, Outlook decides that the whole 
process isn't happening fast enough, so it opens another connection to 
the server and tries to download (potentially) the same message again.

Now, our current server establishes a lock on the mailbox, and when that 
second connection happens it simply responds that there's no messages to 
collect... we used to have it terminate the connection, but this brings 
up confusing error messages on User A's client, and they call up and 
complain -- not an ideal situation.

I've got a dovecot installation on my testing server, and I think I've 
set everything up correctly; it authenticates from my LDAP database, 
finds the home directory, lists the mail, all that... I believe 
somewhere it there it uses fcntl to establish an advisory lock on the 
mailbox (oh, we're using Maildir, by the way).

I'm not sure where, though, or how long the lock persists for, or what 
its actual purpose is, because my tests show me that I can log the same 
users in with two concurrent sessions and get the same message twice. 
It's probably a fault in my understanding of how locking in user 
sessions of a pop3 server should work, but that doesn't sound right to me.

Can someone explain if what I'm seeing is correct, or what problem it 
may be symptomatic of?  Does dovecot even do concurrent-user-session 
locking?  So far I've enjoyed playing with dovecot -- far more than the 
current server we use.  I'd like to use it as our primary pop3 server, 
but preventing users from having concurrent sessions and getting the 
same message more than once, and keeping them from seeing errors because 
of their client trying to open multiple sessions is important.

Oh, and I'm user dovecot 1.0.beta3, since I don't really have the option 
of upgrading the OS on my mail servers any time soon.

Adrian