Zypper update of freshly installed VMA 6 makes SSHD unstartable

[willemdh]

Hello,

Just installed a fresh VMA 6, update with the web GUI to VMA 6.0.0.1 Build 3755529

So as everybody knows several security flaws in Linux have been discovered. So we need to update the packages on this server.. After the fresh install, 250 updates would need an update.

Attempting

su zypper up

results in several failed package installations.

Installing: lockdev-1.0.3_git201003141408-7.1 [error]

Installation of lockdev-1.0.3_git201003141408-7.1 failed:

(with --nodeps --force) Error: Subprocess failed. Error: RPM failed: Usage: chkstat [--set] [--noheader] [[--examine file] ...] [ [--files filelist] ...] permission-file ...

error: %post(lockdev-1.0.3_git201003141408-7.1.x86_64) scriptlet failed, exit status 1

Installation of glib-networking-2.27.90-5.1 failed:

(with --nodeps --force) Error: Subprocess failed. Error: RPM failed: /usr/bin/gio-querymodules-64: symbol lookup error: /lib64/libgobject-2.0.so.0: undefined symbol: g_variant_type_copy

error: %post(glib-networking-2.27.90-5.1.x86_64) scriptlet failed, exit status 127

Installation of libpango-1_0-0-1.28.3-3.6.1 failed:

(with --nodeps --force) Error: Subprocess failed. Error: RPM failed: /usr/bin/pango-querymodules-64: symbol lookup error: /lib64/libgobject-2.0.so.0: undefined symbol: g_variant_type_copy

error: %post(libpango-1_0-0-1.28.3-3.6.1.x86_64) scriptlet failed, exit status 127

Installation of pango-tools-1.28.3-3.6.1 failed:

(with --nodeps --force) Error: Subprocess failed. Error: RPM failed: /usr/bin/pango-querymodules-64: symbol lookup error: /lib64/libgobject-2.0.so.0: undefined symbol: g_variant_type_copy

error: %post(pango-tools-1.28.3-3.6.1.x86_64) scriptlet failed, exit status 127

Installation of libgtk-2_0-0-2.22.1-13.13.2 failed:

(with --nodeps --force) Error: Subprocess failed. Error: RPM failed: /usr/bin/gtk-query-immodules-2.0-64: symbol lookup error: /lib64/libgobject-2.0.so.0: undefined symbol: g_variant_type_copy

error: %post(libgtk-2_0-0-2.22.1-13.13.2.x86_64) scriptlet failed, exit status 127

Installation of gtk2-immodule-vietnamese-2.22.1-13.13.2 failed:

(with --nodeps --force) Error: Subprocess failed. Error: RPM failed: /usr/bin/gtk-query-immodules-2.0-64: symbol lookup error: /lib64/libgobject-2.0.so.0: undefined symbol: g_variant_type_copy

error: %post(gtk2-immodule-vietnamese-2.22.1-13.13.2.x86_64) scriptlet failed, exit status 127

Installing: gtk2-immodule-thai-2.22.1-13.13.2 [error]

Installation of gtk2-immodule-thai-2.22.1-13.13.2 failed:

(with --nodeps --force) Error: Subprocess failed. Error: RPM failed: /usr/bin/gtk-query-immodules-2.0-64: symbol lookup error: /lib64/libgobject-2.0.so.0: undefined symbol: g_variant_type_copy

error: %post(gtk2-immodule-thai-2.22.1-13.13.2.x86_64) scriptlet failed, exit status 127

Installing: gtk2-immodule-inuktitut-2.22.1-13.13.2 [error]

Installation of gtk2-immodule-inuktitut-2.22.1-13.13.2 failed:

(with --nodeps --force) Error: Subprocess failed. Error: RPM failed: /usr/bin/gtk-query-immodules-2.0-64: symbol lookup error: /lib64/libgobject-2.0.so.0: undefined symbol: g_variant_type_copy

error: %post(gtk2-immodule-inuktitut-2.22.1-13.13.2.x86_64) scriptlet failed, exit status 127

Installing: gtk2-immodule-amharic-2.22.1-13.13.2 [error]

Installation of gtk2-immodule-amharic-2.22.1-13.13.2 failed:

(with --nodeps --force) Error: Subprocess failed. Error: RPM failed: /usr/bin/gtk-query-immodules-2.0-64: symbol lookup error: /lib64/libgobject-2.0.so.0: undefined symbol: g_variant_type_copy

error: %post(gtk2-immodule-amharic-2.22.1-13.13.2.x86_64) scriptlet failed, exit status 127

Installation of gvfs-1.6.6-6.1 failed:

(with --nodeps --force) Error: Subprocess failed. Error: RPM failed: /usr/bin/gio-querymodules-64: symbol lookup error: /lib64/libgobject-2.0.so.0: undefined symbol: g_variant_type_copy

error: %post(gvfs-1.6.6-6.1.x86_64) scriptlet failed, exit status 127

Installation of gnome-keyring-2.32.1-8.4 failed:

(with --nodeps --force) Error: Subprocess failed. Error: RPM failed: /usr/bin/glib-compile-schemas: symbol lookup error: /usr/bin/glib-compile-schemas: undefined symbol: g_variant_type_string_is_valid

error: %post(gnome-keyring-2.32.1-8.4.x86_64) scriptlet failed, exit status 127

Installation of gsettings-backend-dconf-0.7.2-2.1 failed:

(with --nodeps --force) Error: Subprocess failed. Error: RPM failed: /usr/bin/gio-querymodules-64: symbol lookup error: /lib64/libgobject-2.0.so.0: undefined symbol: g_variant_type_copy

error: %post(gsettings-backend-dconf-0.7.2-2.1.x86_64) scriptlet failed, exit status 127

After ignoring the above failed packages and rebooting the server, I'm unable to SSH into the server. using the VMware console show sme that the sshd service is stopped and I'm unable to start it.

I get:

symbol lookup error and undefined symbol: FIPS_mode

Did someone ever try to update their VMA 6? Why doesn't this work? Any suggestions?

Grtz

Willem

[danbarr]

I get the same behavior on both a fresh vMA and one that had been upgraded from 5.5. Have you opened an SR about it? I plan to on Monday if you haven't heard anything from support about a resolution. Not being able to keep virtual appliances up-to-date with security fixes is a real problem, especially one with management access to the whole vSphere infrastructure like vMA.

[danbarr]

Response from support was basically that running 'zypper update' on the vMA is not supported and should not be done. I suggested they should remove the opensuse repository configuration from /etc/zypp/repos.d then.

Frankly I wouldn't be surprised to see VMware drop the vMA soon. The support engineer hadn't even ever dealt with it, he had to ask someone else what it was. We've gone ahead and removed vMA from our environment as we can't have it sitting around if it's not at least going to get OS security updates. I only really used it as a last resort so it's not a big loss.

[alanrenouf]

Sorry about the issues you hit here, I just wondered if you had considered using vCLI rather than vMA, this will allow you to use the same functionality but maintain the OS updates and treat less as a sealed appliance.

[danbarr]

I do have vCLI installed on several of our jump hosts, and for day-to-day I pretty much live in PowerCLI (especially since the esxcli v2 cmdlets are so much more readable in scripts!). vMA was just kind of a nice canned solution, and had some nice things like the server targeting, but I think its day has passed. Thanks for the response Alan!