From e2d581d909c2dde8b0e505c58922ceed5f48732f Mon Sep 17 00:00:00 2001
From: Alessandro Ratti <alessandro_ratti@cipherspace.com>
Date: Fri, 11 Nov 2016 09:03:57 +0100
Subject: [PATCH] Add support for ldap over ssl

---
 web-apache-mysql/alpine/Dockerfile            |   4 ++++
 .../alpine/conf/etc/openldap/certs/cert8.db   | Bin 0 -> 65536 bytes
 .../alpine/conf/etc/openldap/certs/key3.db    | Bin 0 -> 16384 bytes
 .../alpine/conf/etc/openldap/certs/secmod.db  | Bin 0 -> 16384 bytes
 .../alpine/conf/etc/openldap/ldap.conf        |  18 ++++++++++++++++++
 5 files changed, 22 insertions(+)
 create mode 100644 web-apache-mysql/alpine/conf/etc/openldap/certs/cert8.db
 create mode 100644 web-apache-mysql/alpine/conf/etc/openldap/certs/key3.db
 create mode 100644 web-apache-mysql/alpine/conf/etc/openldap/certs/secmod.db
 create mode 100644 web-apache-mysql/alpine/conf/etc/openldap/ldap.conf

diff --git a/web-apache-mysql/alpine/Dockerfile b/web-apache-mysql/alpine/Dockerfile
index c1a914339..f081554db 100644
--- a/web-apache-mysql/alpine/Dockerfile
+++ b/web-apache-mysql/alpine/Dockerfile
@@ -34,6 +34,8 @@ RUN addgroup zabbix && \
             php5-xmlreader \
             php5-ldap \
             php5-json \
+            ca-certificates \
+            openldap-clients \
             ttf-dejavu && \
     rm -rf /var/cache/apk/*
 
@@ -73,6 +75,8 @@ ADD conf/etc/zabbix/apache.conf /etc/zabbix/
 ADD conf/etc/zabbix/apache_ssl.conf /etc/zabbix/
 ADD conf/etc/zabbix/web/zabbix.conf.php /etc/zabbix/web/
 ADD conf/etc/php5/conf.d/99-zabbix.ini /etc/php5/conf.d/
+ADD conf/etc/openldap/ldap.conf /etc/openldap/ldap.conf
+ADD conf/etc/openldap/certs /etc/openldap/certs
 ADD run_zabbix_component.sh /
 
 ENTRYPOINT ["/bin/bash"]
diff --git a/web-apache-mysql/alpine/conf/etc/openldap/certs/cert8.db b/web-apache-mysql/alpine/conf/etc/openldap/certs/cert8.db
new file mode 100644
index 0000000000000000000000000000000000000000..ac40a3325724b598ba93a314d250bd03eb7f479f
GIT binary patch
literal 65536
zcmeI)F$w}P5CFjS6uHXI_nfb=x3I9e1Fe0AAM*=#)`FF2lC!k)NHq&fmLz1uJYZwF
z-bF+cvA9NTQW>j=Sz2;N`z_LW*_fBL9F3PQ{rQ&ma^yQXt4BNjr+Qxv2@oJafB*pk
z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs
z0RjXF5FkK+z*GWFJiAACPx%%E2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+
z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+Kt+Kz4G-AvkEg@XPc=rs
zI|K+2AV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+
z009C72oNAZfB*pk1PBlyK!Cs>0<Vg52ecwUfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF
z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7ehYj6JGXse

literal 0
HcmV?d00001

diff --git a/web-apache-mysql/alpine/conf/etc/openldap/certs/key3.db b/web-apache-mysql/alpine/conf/etc/openldap/certs/key3.db
new file mode 100644
index 0000000000000000000000000000000000000000..7a638718ae9e2f6b16e4e42b5e379fdc8071090e
GIT binary patch
literal 16384
zcmeI$y-EW?5Ww*{FNpz9*Fvi_VxuUjQfMjIXk`kqKQD)0M=s<<L9sNIg@qvq;tN<<
zh)GDmR}cbu0<A<lK}G!7JADF+lfZvq*kNX2mS4G&8ns2FPbAS18P=s(B8EP~l=N?*
z=TXCq&S)f2T`eBm>0TJ&oiJmM^v`=@-^)S-5I_I{1Q0*~0R#|0009JgMIa?_>Qz0c
zy1Gy`b*S@;KmY**5I_I{1Q0*~0R#|00D*V}oMkWPo?hjfW7D7Kk0-T>`q1T?=dapc
zHn6>IbHwOoa%Y|SrKjuW<lg>Hf1{K<T9kpQ%0lI3(6Ew*d6Rg5p1E(|wvMgM{P^r#
z$qs^Dzg);V>#nn9uDIo3!!P#AKLzhZ009ILKmY**5I_I{1Q0*~fxioU#PgrQ76cGL
V009ILKmY**5I_I{1Q7T~fp33=oB{v<

literal 0
HcmV?d00001

diff --git a/web-apache-mysql/alpine/conf/etc/openldap/certs/secmod.db b/web-apache-mysql/alpine/conf/etc/openldap/certs/secmod.db
new file mode 100644
index 0000000000000000000000000000000000000000..9e50a3f9dd0e618a6030d4dd8b53ce75f400f45e
GIT binary patch
literal 16384
zcmeI&O-chX6bJBETS^hBZUh%10T<bID2TgR)rC@&V!gn0l9tdh875QEMUUa$8+Z)Y
zdIi0J2auY~RN5lAET#MdnK$`*^YU8{)ej>g+99gF6CJo$+9RsC;5#+uFK)e<s1~tU
z@@J^>q^BP)`sT;Jue~+Ode;73d=LT<fB*y_009U<00Izz00bZa0SG_<0uX=z1Rwwb
z2tWV=5P$##Ah0O{HTv9tYrZz8P2>8eRE0Vq009U<00Izz00bZa0SG`~y9DaQ=yK&s
zVr8^@YfR2MGRrL;1rwVEi5i@r`KPuv9uHK@8h>JGpU?TV@<({rZSZ-^$>W=TpIzx(
zW;#k(uiNRf({`I(8!<_w+w~F~Jyav1vXBQdj{}oRorow6VqXVmKJ+p<R1YENY%Cua
z11sZuBSK!rmKbn0Orntu*(4QFE{mjmKJeFC94$9=m$Q{q%H{h#a%aX;Uq~BgD$SMA
uex>|b|G7E~UGXQb|7rhS_<M#10SG_<0uX=z1Rwwb2tWV=5P-n83;Y1+TwYiJ

literal 0
HcmV?d00001

diff --git a/web-apache-mysql/alpine/conf/etc/openldap/ldap.conf b/web-apache-mysql/alpine/conf/etc/openldap/ldap.conf
new file mode 100644
index 000000000..aa6f8fd4d
--- /dev/null
+++ b/web-apache-mysql/alpine/conf/etc/openldap/ldap.conf
@@ -0,0 +1,18 @@
+#
+# LDAP Defaults
+#
+
+# See ldap.conf(5) for details
+# This file should be world readable but not world writable.
+
+#BASE	dc=example,dc=com
+#URI	ldap://ldap.example.com ldap://ldap-master.example.com:666
+
+#SIZELIMIT	12
+#TIMELIMIT	15
+#DEREF		never
+
+TLS_CACERTDIR	/etc/openldap/certs
+
+# Turning this off breaks GSSAPI used with krb5 when rdns = false
+SASL_NOCANON	on