Apache2 can't start: ssl.load Permission Denied

Question

I'm setting up an HTTPS server on an Ubuntu 10.04 LTS Server.

After configuring everything, when I try to start the server I get:

root@dns2:/etc/apache2# /etc/init.d/apache2 start
 * Starting web server apache2
apache2: Syntax error on line 204 of /etc/apache2/apache2.conf: Could not open configuration file /etc/apache2/mods-enabled/ssl.load: Permission denied
   ...fail!

The relevant line 204 in apache2.conf is Include /etc/apache2/mods-enabled/*.load

mods-enabled (soft-links to mods-available as per standard):

root@dns2:/etc/apache2# ls -l mods-enabled
total 0
<stuff>
lrwxrwxrwx 1 root root 26 2011-06-17 16:24 ssl.conf -> ../mods-available/ssl.conf
lrwxrwxrwx 1 root root 26 2011-06-17 16:24 ssl.load -> ../mods-available/ssl.load
<stuff>

mods-available:

-rw-r--r-- 1 root root 2412 2010-11-18 13:18 ssl.conf
-rw-r--r-- 1 root root   58 2010-11-18 13:18 ssl.load

I can't see any reason why this error comes up. I am utterly confounded. Any ideas?

EDIT: sites-available and sites-enabled directory permissions

drwxr-xr-x 2 root root  4096 2011-06-17 16:36 sites-available
drwxr-xr-x 2 root root  4096 2011-06-17 16:28 sites-enabled

EDIT2: I tried disabling the ssl module and starting apache:

root@dns2:/etc/apache2# a2dismod ssl
Module ssl disabled.
Run '/etc/init.d/apache2 restart' to activate new configuration!
root@dns2:/etc/apache2# /etc/init.d/apache2 start
 * Starting web server apache2
apache2: Syntax error on line 236 of /etc/apache2/apache2.conf: Could not open configuration file /etc/apache2/sites-enabled/000-default-ssl: Permission denied
   ...fail!

000-default-ssl points to the default ssl virtual host config file. Again, all permissions are right. After removing 000-default-ssl, apache starts normally. Obviously, since now it's back to the default configuration...

Answer 1

Remember to check not only the directory the files are in but all paths up until that directory. No point checking /etc/apache2/mods-enabled/ when (eg) /etc/apache2/ is only 700 ;)

try starting it as root using apaches control command.

apache2ctl start

or

sudo apache2ctl start

as a user. Check if you get the same error or any more information.

Answer 2

I figured out what's happening. My AppArmor profile for apache2 was blocking access to mod_ssl. Allowing apache2 to access said files in its AppArmor profile fixes everything. Well, at least I know AppArmor is doing its job properly =)

I don't know if I should ask another question for this, but is AppArmor good enough security for apache? I really don't want to chroot apache, and I've heard something about chrooting not being very secure.