Bad patch management at Sun

May 9, 2006

Today, I tried to use ssh from my Solaris test machine to another machine for the first time in a while (I usually push stuff the other way):

$ scp pca-out.html linux:www/
dlopen(/usr/lib/gss/gl/mech_krb5.so): ld.so.1: ssh: fatal: /usr/lib/gss/gl/mech_krb5.so: open failed: No such file or directory
xmalloc: zero size

Uh oh, thought I. Had one of the patches I'd rolled on recently done something? There had been a Solaris SSH patch in the collection. So I nervously went off to one of the production machines:

$ ssh sol-serv
unable to initialize mechanism library [/usr/lib/gss/gl/mech_krb5.so]
cks@sol-serv's password:

Houston, we have a problem.

It turns out that this is a known issue, present even in recent Solaris 9 Recommended patch sets. According to one report the culprit is patch 113273-11, which does not properly check whether various Kerberos bits were installed before adding things that depend on them; this may be why Sun played peculiar games with some krb5 related patches, as noted on the pca notes page. If so, it's a pity that Sun didn't say anything specific and direct about it.

(For more discussion and some workarounds, see here, here, and here, all found through Google.)

The whole set of bugs irritates me, because it shows that Solaris's package and patch management infrastructure is dangerously weak. In a real package management system, you cannot accidentally drop dependencies like this. No Debian upgrade and no set of Red Hat packages would have wound up like this; as a minimum they would have aborted at update time, rather than damaging my systems.

I also have to fault Sun's testing. It's one thing to have this happen in a patch, another thing to have it happen in a recommended patch, and an entirely unpleasant thing to have the patch make it into a recommended patch cluster. It's not like our Solaris configurations are exotic, either, regardless of what Sun thinks. (Not fixing it for more than a month doesn't help, either.)

Oh well. Time to become rather more familiar with how to load packages into Solaris systems, and what the effects of adding Kerberos packages to an existing system are.

Update, June 10th 2006: see FixingSolarisSsh for what I've figured out about how to work around this problem. (I wound up not adding the Kerberos packages, partly because it turns out not to help all that much.)


Comments on this page:

From 70.53.120.146 at 2006-05-10 07:42:03:

I don't know why they released these ssh patches without the extensive testing they usually do with every patch - people used to complain that Sun took too long to release patches due to their rigorous test cycle.

In this case with ssh in Solaris 9, I believe the problems started when they backported sun-ssh from Solaris 10.

At least there are easy workarounds.

Oscar@MIE

Written on 09 May 2006.
« Link: an excerpt from On Writing Well
The practical cost of forking in Python »

Page tools: View Source, View Normal, Add Comment.
Search:
Login: Password:
Atom Syndication: Recent Comments.

Last modified: Tue May 9 01:38:02 2006
This dinky wiki is brought to you by the Insane Hackers Guild, Python sub-branch.