I managed to get the e-mail server working again. There were a huge number of changes related to new init scripts in the new version. I probably should have done a clean install instead of trying an upgrade.

Among the problems were

  • An AppArmor profile in complain mode that nonetheless seems to have blocked writes to a Unix socket,
  • Changes to the startup scripts that services use, so that OpenDKIM and SpamAssassin were both looking at default socket locations instead of the ones I had previously configured,
  • Changes to when SpamAssassin looks at /etc/resolve.conf, so that DNS lookups were sent to localhost instead of the resolvers that were configured later in the startup process,
  • Permissions changes done by the package upgrades, and
  • A more sensitive parser for Fail2Ban configs that fails when it didn’t used to.

Anyway, mail service seems to be back. So, that’s nice.