Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm setting up an HTTPS server on an Ubuntu 10.04 LTS Server.

After configuring everything, when I try to start the server I get:

root@dns2:/etc/apache2# /etc/init.d/apache2 start
 * Starting web server apache2
apache2: Syntax error on line 204 of /etc/apache2/apache2.conf: Could not open configuration file /etc/apache2/mods-enabled/ssl.load: Permission denied
   ...fail!

The relevant line 204 in apache2.conf is Include /etc/apache2/mods-enabled/*.load

mods-enabled (soft-links to mods-available as per standard):

root@dns2:/etc/apache2# ls -l mods-enabled
total 0
<stuff>
lrwxrwxrwx 1 root root 26 2011-06-17 16:24 ssl.conf -> ../mods-available/ssl.conf
lrwxrwxrwx 1 root root 26 2011-06-17 16:24 ssl.load -> ../mods-available/ssl.load
<stuff>

mods-available:

-rw-r--r-- 1 root root 2412 2010-11-18 13:18 ssl.conf
-rw-r--r-- 1 root root   58 2010-11-18 13:18 ssl.load

I can't see any reason why this error comes up. I am utterly confounded. Any ideas?

EDIT: sites-available and sites-enabled directory permissions

drwxr-xr-x 2 root root  4096 2011-06-17 16:36 sites-available
drwxr-xr-x 2 root root  4096 2011-06-17 16:28 sites-enabled

EDIT2: I tried disabling the ssl module and starting apache:

root@dns2:/etc/apache2# a2dismod ssl
Module ssl disabled.
Run '/etc/init.d/apache2 restart' to activate new configuration!
root@dns2:/etc/apache2# /etc/init.d/apache2 start
 * Starting web server apache2
apache2: Syntax error on line 236 of /etc/apache2/apache2.conf: Could not open configuration file /etc/apache2/sites-enabled/000-default-ssl: Permission denied
   ...fail!

000-default-ssl points to the default ssl virtual host config file. Again, all permissions are right. After removing 000-default-ssl, apache starts normally. Obviously, since now it's back to the default configuration...

share|improve this question
    
What are the permisisons on the mods-enabled and the mods-available directories? –  larsks Jun 18 '11 at 0:33

2 Answers 2

Remember to check not only the directory the files are in but all paths up until that directory. No point checking /etc/apache2/mods-enabled/ when (eg) /etc/apache2/ is only 700 ;)

try starting it as root using apaches control command.

apache2ctl start

or

sudo apache2ctl start

as a user. Check if you get the same error or any more information.

share|improve this answer
    
/etc and /etc/apache2 are both 755. apache2ctl start gives the same error. Thanks for the reminder though; I'm sure I'm missing something ridiculously simple somewhere... –  darkfeline Jun 18 '11 at 4:26
    
I would disable ssl, start apache and confirm it starts ok, then enable it again using /usr/sbin/a2enmod incase you did it any other way. There must be some hidden error like /usr/lib/apache2/modules/mod_ssl.so is the one that's the permission issue or error. –  George Vieira Jun 18 '11 at 5:27
    
What user is apache running as, to be sure check with grep ^User /etc/apache2/apache2.conf and/or grep APACHE_RUN /etc/apache2/envvars. I'm sure if this was www-data then you should be able to su to it and cat the files in question just for curiosity. –  George Vieira Jun 18 '11 at 6:01
    
I checked apache2.conf and envvars, apache is indeed running as www-data. su www-data and I can cat both ssl.load and 000-default-ssl fine, as expected. Tried starting apache again, same error. –  darkfeline Jun 18 '11 at 7:26
up vote 0 down vote accepted

I figured out what's happening. My AppArmor profile for apache2 was blocking access to mod_ssl. Allowing apache2 to access said files in its AppArmor profile fixes everything. Well, at least I know AppArmor is doing its job properly =)

I don't know if I should ask another question for this, but is AppArmor good enough security for apache? I really don't want to chroot apache, and I've heard something about chrooting not being very secure.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.