[strongSwan] Let's Encrypt CA Expiry & related StrongSWAN trouble

[Simon Deziel]

On 2021-10-06 12:22 p.m., Simon Deziel wrote:
> On 2021-10-06 12:08 p.m., Philip Veale wrote:
>> I hadn't tried that, but tried, didn't change anything. I noticed things
>> specifically related to StrongSWAN aren't working since the update to
>> Bullseye and swanctl is not a recognised command. StrongSWAN is installed
>> via apt, version 5.9.1-1
>>
>> swanctl doesn't exist as a command and there is no service called
>> strongswan anymore. I'm not sure how weird that is.
> 
> swanctl lives in a different package. The strongswan unit got renamed to 
> strongswan-starter.
> 
>> Just been trawling more logs and spotted something else which should be a
>> massive clue;
>>
>> Oct  6 16:43:55 VPN-Server charon: 00[CFG] loading secrets from
>> '/etc/ipsec.secrets'
>> Oct  6 16:43:55 VPN-Server charon: 00[LIB]   opening
>> '/etc/letsencrypt/live/vpn.my-hostname/privkey.pem' failed: Permission
>> denied
>> Oct  6 16:43:55 VPN-Server charon: 00[LIB] building CRED_PRIVATE_KEY - 
>> RSA
>> failed, tried 11 builders
>> Oct  6 16:43:55 VPN-Server charon: 00[CFG]   loading private key from
>> '/etc/letsencrypt/live/vpn.my-hostname/privkey.pem' failed
>>
>>
>> So yeah it looks like it's a simple permissions issue, I'm guessing the
>> dist upgrade has changed the user the service runs as and that uid 
>> doesn't
>> have read access to the privkey. I should have thought of that. For some
>> reason I thought it just ran as root.
>>
>> Oh..so no, it does run as root, but It's AppArmor, interfering with 
>> Charon
>> apparently - the PEM files are created by certbot with symlinks (from
>> 'live' to 'archive') as it rotates through and creates new ones, keeping
>> the old, the newest versions are always symlinked.
>>
>> Debian Stretch didn't have AppArmor but it's been enabled by default in
>> Debian since Buster. So yeah, the dist-upgrade kinda broke things.
>>
>> Thanks to Simon Deziel in this old thread from years ago;
>> https://lists.strongswan.org/pipermail/users/2017-February/010537.html
>>
>>
>> I've not quite yet figured out how I want to fix it (there are a few
>> options) but at least I know why it does not work.
> 
> 
> At first glance, I'd add "#include <abstractions/ssl_keys>" to charon's 
> profile. Would you mind testing this for me (as root):

Oops, here's the corrected version:

cat < EOF >> /etc/apparmor.d/local/usr.lib.ipsec.charon
#include <abstractions/ssl_keys>
EOF
apparmor_parser -rTW /etc/apparmor.d/usr.lib.ipsec.charon
systemctl restart strongswan-starter

Simon