Re: [cobalt-users] RaQ4: Issue installing Glibc Security Update 2.0.1 - segfaults abound - ADDITIONAL NOTE

[Goetz Lohmann <goetz.lohmann@xxxxxx>]

jigou@xxxxxxxxx schrieb:

>
>ADDITIONAL NOTE: The machine DOES NOT respond to the front panel buttons,
>either....
>
>
>I had an (unknown) issue installing the Glibc Security Update 2.0.1 on a
>RaQ4 appliance.
>
>(I installed the software on a test box configured the same with no issues,
>same .pkg file. - so I know the .pkg file is OK)
>
>After installing via the browser interface, I was met with an error at the
>bottom of the page that said there was a problem installing an rpm file.
>Unfortunately, it flashed away too quickly for me to get the exact rpm
>file. I was then prompted for my administrator login/password again, which
>was where the strangeness begins.
>
>In the background, I had (well, still have) two ssh sessions running - one
>with TOP monitoring the server, and another at a command prompt.
>
>I can change directories from the command prompt, but any other command
>(ls, /etc/rc.d/init.d/httpd status, etc) is met with "Segmentation fault."
>Top continues to run just fine.
>
>The web pages on the machine ARE still being served up properly.
>
>I cannot log into the machine via FTP, nor can I create a new connection
>via SSH.
>
>When I attempt to access the admin panel, I'm challenged for my username
>and password, as I should be; after entering the information, I'm
>challenged again, immediately, as though I typed the wrong password.
>
>When I try to log in via SSH, PuTTY says "Server sent disconnect message:
>Command terminated on signal 11" - this is displayed after the last login,
>"Type pine or mail to read you email", etc. message, but BEFORE the Root
>User notice (the "don't touch this wrong or your warranty is void" warning)
>.
>
>Details about the machine:
>RaQ4r
>512MB RAM
>All patches UP TO the glibc patch
>Nothing locking me out security-wise
>
>Output from top:
> 9:47am  up  1:40,  2 users,  load average: 0.02, 0.01, 0.00
>55 processes: 54 sleeping, 1 running, 0 zombie, 0 stopped
>CPU states:  1.1% user,  1.3% system,  0.0% nice, 97.4% idle
>Mem:   517104K av,  463860K used,   53244K free,  143456K shrd,  336656K
>buff
>Swap:  131448K av,       0K used,  131448K free                   40368K
>cached
>
>No processes are hogging resources - Top is at the...well, top of the list
>with 1.5% of the CPU.
>
>I restarted the machine earlier this morning (twice, actually) with no ill
>effects.
>
>Help, please? I'm tempted to reboot the server to see what happens, but am
>a little nervous about that...
>
>Jarrod
>
sound like you are hacked ... but moreover I think it's just in fact
that a glibc update is always a
bit hot, cause it changes elementary things of your box. That's why you
need to reboot it.
The deamons running in the background trying to call the old glibc
stuff. If they now load the
librarys they fail cause the pointer adresses have changed which cause a
segmenation fault.
That's pretty like the things you told.
maybe you could try this:

maybe did you install MidnightCommander (mc) then you could try it to
browse the system.

maybe check the installed RPMs with

# rpm -qa | grep glibc
glibc-2.1.3-29
glibc-devel-2.1.3-29
glibc-profile-2.1.3-29
# rpm -qa | grep nscd
nscd-2.1.3-29.i386.rpm

(this 4 RPMs are installed by the Package!)

maybe to reinstall in your ssh shell type:

# cd /tmp
# wget *RaQ4-All-Security-2.0.1-15578.pkg*
<http://ftp.cobalt.sun.com/pub/packages/raq4/eng/RaQ4-All-Security-2.0.1-15578.pkg>
# coblat_upgrade *RaQ4-All-Security-2.0.1-15578.pkg*
<http://ftp.cobalt.sun.com/pub/packages/raq4/eng/RaQ4-All-Security-2.0.1-15578.pkg>

or better

# cd /tmp
# wget *RaQ4-All-Security-2.0.1-15578.pkg*
<http://ftp.cobalt.sun.com/pub/packages/raq4/eng/RaQ4-All-Security-2.0.1-15578.pkg>
# tar -zxvf *RaQ4-All-Security-2.0.1-15578.pkg*
<http://ftp.cobalt.sun.com/pub/packages/raq4/eng/RaQ4-All-Security-2.0.1-15578.pkg>
# cd RPMS
# rpm -Uvh glibc*.rpm  nscd*.rpm

You should better always install this Stuff Kernel & GLibC by wget &
cobalt_upgrade cause its far
more safe (In fact you can read which rpm failed and why)

regards