From 5118f8d3394579a245b355c863c69410fe92e26e Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Thu, 21 May 2020 01:35:28 +0200
Subject: dovecot-auth-proxy: replace directory traversal with LDAP lookups.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This provides better isolation opportunity as the service doesn't need
to run as ‘vmail’ user.  We use a dedicated system user instead, and
LDAP ACLs to limit its access to the strict minimum.

The new solution is also more robust to quoting/escaping, and doesn't
depend on ‘home=/home/mail/virtual/%d/%n’ (we might use $entryUUID
instead of %d/%n at some point to make user renaming simpler).

OTOH we no longer lists users that have been removed from LDAP but still
have a mailstore lingering around.  This is fair.
---
 lib/modules/openldap | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/modules/openldap b/lib/modules/openldap
index 9afe1f1..219c9a6 100644
--- a/lib/modules/openldap
+++ b/lib/modules/openldap
@@ -61,7 +61,7 @@ indexedDN = {
 # 102 is postfix's UID and 106 its primary GID.
 # (Regular expressions are not allowed.)
 sasl_ext_re = re.compile( r"""(?P<start>\sby\s+dn(?:\.exact)?)=
-                              (?P<quote>['\"]?)username=(?P<user>[a-z][-a-z0-9_]*),
+                              (?P<quote>['\"]?)username=(?P<user>_?[a-z][-a-z0-9_]*),
                               (?P<end>cn=peercred,cn=external,cn=auth)
                               (?P=quote)\s"""
                         , re.VERBOSE )
-- 
cgit v1.2.3