fix(dovecot): disable LDAP referral chasing

[DavidePrincipi]

Summary

Dovecot's LDAP client was chasing AD LDAP referrals, causing unexpected direct connections to port 636 on the LDAP server, bypassing Ldapproxy. Referrals are now disabled so Dovecot only connects through Ldapproxy as configured by the environment variables set for the Dovecot container.

Partially reverts a previous workaround for a related log flood bug #76

Related issue

NethServer/dev#8097

How to test

1. Deploy the mail module against an AD-backed LDAP server that returns
   referrals.

2. Confirm "Decryption failed" lines are no more sent to journal:

   journalctl -f --grep Decryption
   

[stephdl]

Question on the file path before I approve — which of these two will libldap actually read?

    # cat /etc/openldap/ldap.conf
    #
    # LDAP Defaults
    #
    # See ldap.conf(5) for details
    # This file should be world readable but not world writable.
    #BASE   dc=example,dc=com
    #URI    ldap://ldap.example.com ldap://ldap-provider.example.com:666
    #SIZELIMIT      12
    #TIMELIMIT      15
    #DEREF          never

    # cat /etc/dovecot/openldap/ldap.conf
    #
    # LDAP Defaults
    #
    # See ldap.conf(5) for details
    # This file should be world readable but not world writable.
    #BASE   dc=example,dc=com
    #URI    ldap://ldap.example.com ldap://ldap-provider.example.com:666
    #SIZELIMIT      12
    #TIMELIMIT      15
    #DEREF          never
    # Dovecot chases AD LDAP referrals with unexpected direct connections to
    # port 636. Disable referral chasing. See issue #8097
    REFERRALS off

Both are present in the image built from bug-8097, and only the second one carries the option.

The reason it ends up there: the file is added as dovecot/etc/dovecot/openldap/ldap.confin the repo, andbuild-images.shdoesbuildah add "${container}" dovecot/ /, which copies the whole dovecot/tree to/verbatim — the leadingetc/dovecot/is part of the destination path, so it lands on/etc/dovecot/openldap/ldap.conf. libldap reads $LDAPCONFand then the compiled sysconfdir file, which on Alpine is/etc/openldap/ldap.conf, and I don't see LDAPCONF` set anywhere in the repo.

So unless I'm missing something, the file just needs to be shipped as
dovecot/etc/openldap/ldap.conf so that buildah add overwrites the real one. Your content is byte-for-byte Alpine's own /etc/openldap/ldap.conf plus the two appended lines, so overwriting it loses nothing.

[DavidePrincipi]

Nice catch, the path was wrong! Thank you for pointing it out!