dovecot-auth-proxy: replace directory traversal with LDAP lookups.

This provides better isolation opportunity as the service doesn't need
to run as ‘vmail’ user.  We use a dedicated system user instead, and
LDAP ACLs to limit its access to the strict minimum.

The new solution is also more robust to quoting/escaping, and doesn't
depend on ‘home=/home/mail/virtual/%d/%n’ (we might use $entryUUID
instead of %d/%n at some point to make user renaming simpler).

OTOH we no longer lists users that have been removed from LDAP but still
have a mailstore lingering around.  This is fair.

1 files changed, 1 insertions, 1 deletions

diff --git a/lib/modules/openldap b/lib/modules/openldap
index 9afe1f1..219c9a6 100644
--- a/lib/modules/openldap
+++ b/lib/modules/openldap
@@ -44,41 +44,41 @@ indexedAttributes = frozenset([
 
 # Another hack. Configuration entries sometimes pollutes the DNs with
 # indices, thus it's not possible to directly use them as base.
 # Instead, we use their parent as a base, and search for the *unique*
 # match with the same ObjectClass and the matching extra attributes.
 # ('%s' in the attribute value is replaced with the value of the source
 # entry.)
 indexedDN = {
     'olcSchemaConfig':  [('cn',             '{*}%s')],
     'olcMdbConfig':     [('olcDbDirectory', '%s'   )],
     'olcOverlayConfig': [('olcOverlay',     '%s'   )],
     'olcMonitorConfig': [],
 }
 
 # Allow for flexible ACLs for user using SASL's EXTERNAL mechanism.
 # "username=postfix,cn=peercred,cn=external,cn=auth" is replaced by
 # "gidNumber=106+uidNumber=102,cn=peercred,cn=external,cn=auth" where
 # 102 is postfix's UID and 106 its primary GID.
 # (Regular expressions are not allowed.)
 sasl_ext_re = re.compile( r"""(?P<start>\sby\s+dn(?:\.exact)?)=
-                              (?P<quote>['\"]?)username=(?P<user>[a-z][-a-z0-9_]*),
+                              (?P<quote>['\"]?)username=(?P<user>_?[a-z][-a-z0-9_]*),
                               (?P<end>cn=peercred,cn=external,cn=auth)
                               (?P=quote)\s"""
                         , re.VERBOSE )
 multispaces = re.compile( r"\s+" )
 pwd_dict = {}
 
 def acl_sasl_ext(m):
     u = m.group('user')
     if u not in pwd_dict.keys():
         pwd_dict[u] = pwd.getpwnam(u)
     return '%s="gidNumber=%d+uidNumber=%d,%s" ' % ( m.group('start')
                                                   , pwd_dict[u].pw_gid
                                                   , pwd_dict[u].pw_uid
                                                   , m.group('end')
                                                   )
 
 
 # Run the given callback on each DN seen.  If its return value is not
 # None, update the changed variable.
 class LDIFCallback(LDIFParser):