Add ssh-box role

Authentication is done through libpam-ldapd. Users on the internal
network only need to authenticate with their password. All other users
need to authenticate with a pubkey and their password. The password is
required so that libpam-mount can still mount the user's home directory.
Pubkeys are stored in the gecos field simply for convince (the nslcd
daemon syncs the gecos field) and so that the AD schema need not be
changed.