dovecot-auth-proxy: replace directory traversal with LDAP lookups.

This provides better isolation opportunity as the service doesn't need
to run as ‘vmail’ user.  We use a dedicated system user instead, and
LDAP ACLs to limit its access to the strict minimum.

The new solution is also more robust to quoting/escaping, and doesn't
depend on ‘home=/home/mail/virtual/%d/%n’ (we might use $entryUUID
instead of %d/%n at some point to make user renaming simpler).

OTOH we no longer lists users that have been removed from LDAP but still
have a mailstore lingering around.  This is fair.

1 files changed, 16 insertions, 0 deletions

diff --git a/roles/IMAP/tasks/imap.yml b/roles/IMAP/tasks/imap.yml
index 429854e..4a157af 100644
--- a/roles/IMAP/tasks/imap.yml
+++ b/roles/IMAP/tasks/imap.yml
@@ -1,52 +1,68 @@
 - name: Install Dovecot
   apt: pkg={{ packages }}
   vars:
     packages:
     - dovecot-core
     - dovecot-ldap
     - dovecot-imapd
     - dovecot-lmtpd
     - dovecot-antispam
     - dovecot-managesieved
     - dovecot-sieve
 
 - name: Create a user 'vmail'
   user: name=vmail system=yes
         createhome=no
         home=/home/mail
         shell=/usr/sbin/nologin
         password=!
         state=present
 
+- name: Install Net::LDAP and Authen::SASL
+  apt: pkg={{ packages }}
+  vars:
+    packages:
+    - libnet-ldap-perl
+    - libauthen-sasl-perl
+
 - name: Copy dovecot auth proxy
   copy: src=usr/local/bin/dovecot-auth-proxy.pl
         dest=/usr/local/bin/dovecot-auth-proxy.pl
         owner=root group=staff
         mode=0755
 
 # Required for IDLE as all imap processes have the same UID (vmail).
 - name: Set per user maximum number of inotify instances to 512
   sysctl: name=fs.inotify.max_user_instances value=512 sysctl_set=yes
   tags:
    - sysctl
 
+- name: Create '_dovecot-auth-proxy' user
+  user: name=_dovecot-auth-proxy system=yes
+        group=nogroup
+        createhome=no
+        home=/nonexistent
+        shell=/usr/sbin/nologin
+        password=!
+        state=present
+
 - name: Copy dovecot auth proxy systemd unit files
   copy: src=etc/systemd/system/{{ item }}
         dest=/etc/systemd/system/{{ item }}
         owner=root group=root
         mode=0644
   with_items:
     - dovecot-auth-proxy.service
     - dovecot-auth-proxy.socket
   notify:
     - systemctl daemon-reload
 
 - meta: flush_handlers
 
 - name: Enable dovecot auth proxy
   service: name=dovecot-auth-proxy.socket state=started enabled=yes
 
 # The ownership and permissions ensure that dovecot won't try to
 # deliver mails under an umounted mountpoint.
 - name: Create a home directory for user 'vmail'
   file: path=/home/mail