<html><head></head><body><div>Alexander good afternoon. Thank you. I have spent the day learning about AppArmor:</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>• I've reviewed your link, found <b>/etc/apparmor.d/</b> and its <b>local/ </b>directory.</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>• I ran <b>aa-logprof </b>and it found the change in <b>stat </b>to <b>old-stat</b> that is discussed in the upgrade documentation. So I <b>Allow (A)</b> that. There are no other reports.</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>• I followed the discussion on using <b>yast</b> to manage the profiles. I'm on <b>ssh</b> to the server so do not have the GUI <b>yast</b>, only the ncurses version and it does not contain editing, only adding, profiles.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>I tried creating a profile for <b>imap-login</b> with that method and scanned for any issues, there were none reported, but still cannot log in.</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>• I followed the local/README to explicitly add</div><pre><span class="Apple-tab-span" style="white-space:pre"> </span>/etc/certbot/live/privustech.com/* r,</pre>
<div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>to <i>/etc/apparmor.d/<strong>local</strong>/usr.lib.dovecot.imap-login </i>but still cannot login with either the mail client or with explicit <b>openssl: </b>it complains</div><div><span class="Apple-tab-span" style="white-space:pre"><b> </b></span><span style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-family: monospace;">error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:<b>s23_clnt.c</b>:794:</span></div><div><span style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-family: monospace;"><span class="Apple-tab-span" style="white-space:pre"> </span></span></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>I check <b>y</b><b>ast2 sw_single</b> for the dovecot installation. Indeed the module <b>dovecot23-xxx </b>where <b>xxx</b> is anything that looks like "<b>clnt"</b> (client?) does not exist. Is there a missing module in my installation? It lists only</div><div><span style="font-family:monospace"><span class="Apple-tab-span" style="white-space:pre"> </span></span><span style="font-family: monospace; font-weight: bold; color: rgb(255, 255, 84); background-color: rgb(24, 178, 178);">dovecot</span><span style="font-family: monospace; color: rgb(178, 104, 24); background-color: rgb(24, 178, 178);"></span></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>dovecot23</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>dovecot23-backend-mysql</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>dovecot23-backend-pgsql</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>dovecot23-backend-sqlite</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>dovecot23-fts</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>dovecot23-fts-squat</div><div><span style="font-family: monospace; font-weight: bold; color: rgb(255, 255, 84); background-color: rgb(24, 178, 178);"><br></span></div>
<div>I'll pursue this further.</div><div><br></div><div>Thank <span class="Apple-tab-span" style="white-space:pre"> </span>you again.</div><div><br></div><div>Kind regards, Andy</div><div><span class="Apple-tab-span" style="white-space:pre"> </span></div><div><br></div><div>On Fri, 2018-12-14 at 23:44 +0100, Alexander Dalloz wrote:</div><blockquote type="cite"><pre>Am 14.12.2018 um 19:58 schrieb C. Andrews Lavarre:
<blockquote type="cite">
Thanks for the input. I've checked out your suggestions (details below)
but unfortunately no joy.
I also restored my backup 10-ssl.conf. It indeed has the "<" sign with
a space before the explicit paths to the files:
ssl_cert = </etc/certbot/live/privustech.com/fullchain.pem
ssl_key = </etc/certbot/live/privustech.com/privkey.pem
</blockquote>
Hi,
the syntax you see in the documentation is mandatory. Your issue is
really a permissions problem.
Check your AppArmor setup. The path you use for storing the chained
certificate and the private key is certainly not known to AppArmor. See
your /var/log/audit/audit.log for indications.
<a href="https://doc.opensuse.org/documentation/leap/security/html/book.security/cha.apparmor.managing.html">https://doc.opensuse.org/documentation/leap/security/html/book.security/cha.apparmor.managing.html</a>
may help.
Btw. permissions setting to 0777, especially for the cert and key, is
awful, even for debugging issues.
Alexander
</pre></blockquote></body></html>