Upgrade from 3.3 to 3.4 - Messup!

[JPB]

After pressing the "Magic" button to Upgrade from 3.3 to 3.4 I got an Error that IPS did not install - depends on suricata.  I did all of the following even tried to remove all apt archives and fetched from another source server!  Someone more clevir than me need to help please!

Code: [Select]

sudo dpkg --configure -a

Code: [Select]

root@chaos:~# sudo dpkg --configure -a
dpkg: error processing suricata (--configure):
 Package is in a very bad inconsistent state - you should
 reinstall it before attempting configuration.
dpkg: dependency problems prevent configuration of zentyal-ips:
 zentyal-ips depends on suricata; however:
  Package suricata is not configured yet.

dpkg: error processing zentyal-ips (--configure):
 dependency problems - leaving unconfigured
Errors were encountered while processing:


Code: [Select]

root@chaos:/var/cache/apt/archives# apt-get install suricata
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages were automatically installed and are no longer required:
  apache2-mpm-prefork apache2.2-bin autotools-dev bc cups-filters foomatic-db foomatic-db-engine foomatic-filters gnustep-make gobjc-4.6 hplip-data
  libapache-singleton-perl libapache2-authcookie-perl libbind9-80 libconfig++8 libconfig8 libcupscgi1 libcupsfilters1 libcupsmime1 libcupsppdc1 libdconf0
  libdm0 libdns81 libexif12 libexporter-cluster-perl libgd2-xpm libgnustep-base1.22 libgphoto2-2 libgphoto2-port0 libhpmud0 libieee1284-3 libisc83
  libisccc80 libisccfg82 liblcms1 liblua5.1-0 liblwres80 libnet-cups-perl libobjc3 libsane libsane-common libsane-hpaio libsnmp-base libsnmp15
  libtcmalloc-minimal0 libtommath0 libv4l-0 libv4lconvert0 linux-headers-3.8.0-30 linux-headers-3.8.0-30-generic php-mdb2 php-mdb2-driver-mysql php5-ldap
  poppler-utils python-apport python-dbus python-dbus-dev python-gi python-gnupginterface python-gobject-2 python-imaging python-keyring
  python-launchpadlib python-lazr.restfulclient python-lazr.uri python-oauth python-pexpect python-problem-report python-reportlab python-wadllib
  python-zope.interface samba4
Use 'apt-get autoremove' to remove them.
Recommended packages:
  oinkmaster
The following packages will be upgraded:
  suricata
1 upgraded, 0 newly installed, 0 to remove and 343 not upgraded.
2 not fully installed or removed.
Need to get 785 kB of archives.
After this operation, 1 501 kB disk space will be freed.
Get:1 http://cz.archive.ubuntu.com/ubuntu/ saucy/universe suricata amd64 1.4.3-1 [785 kB]
Fetched 785 kB in 5s (132 kB/s)
E: Could not open file descriptor -1
debconf: apt-extracttemplates failed: No such file or directory
(Reading database ... 335809 files and directories currently installed.)
Preparing to replace suricata 1.1.1-1 (using .../suricata_1.4.3-1_amd64.deb) ...
 * NFQUEUE support not found !
 * Please ensure the nfnetlink_queue module is loaded or built in kernel
invoke-rc.d: initscript suricata, action "stop" failed.
dpkg: warning: subprocess old pre-removal script returned error exit status 5
dpkg: trying script from the new package instead ...
 * NFQUEUE support not found !
 * Please ensure the nfnetlink_queue module is loaded or built in kernel
invoke-rc.d: initscript suricata, action "stop" failed.
dpkg: error processing /var/cache/apt/archives/suricata_1.4.3-1_amd64.deb (--unpack):
 subprocess new pre-removal script returned error exit status 5
 * NFQUEUE support not found !
 * Please ensure the nfnetlink_queue module is loaded or built in kernel
invoke-rc.d: initscript suricata, action "start" failed.
dpkg: error while cleaning up:
 subprocess installed post-installation script returned error exit status 5
Errors were encountered while processing:
 /var/cache/apt/archives/suricata_1.4.3-1_amd64.deb
E: Sub-process /usr/bin/dpkg returned an error code (1)


Code: [Select]

root@chaos:~# apt-get install -f
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages were automatically installed and are no longer required:
  apache2-mpm-prefork apache2.2-bin autotools-dev bc cups-filters foomatic-db foomatic-db-engine foomatic-filters gnustep-make gobjc-4.6 hplip-data
  libapache-singleton-perl libapache2-authcookie-perl libbind9-80 libconfig++8 libconfig8 libcupscgi1 libcupsfilters1 libcupsmime1 libcupsppdc1 libdconf0
  libdm0 libdns81 libexif12 libexporter-cluster-perl libgd2-xpm libgnustep-base1.22 libgphoto2-2 libgphoto2-port0 libhpmud0 libieee1284-3 libisc83
  libisccc80 libisccfg82 liblcms1 liblua5.1-0 liblwres80 libnet-cups-perl libobjc3 libsane libsane-common libsane-hpaio libsnmp-base libsnmp15
  libtcmalloc-minimal0 libtommath0 libv4l-0 libv4lconvert0 linux-headers-3.8.0-30 linux-headers-3.8.0-30-generic php-mdb2 php-mdb2-driver-mysql php5-ldap
  poppler-utils python-apport python-dbus python-dbus-dev python-gi python-gnupginterface python-gobject-2 python-imaging python-keyring
  python-launchpadlib python-lazr.restfulclient python-lazr.uri python-oauth python-pexpect python-problem-report python-reportlab python-wadllib
  python-zope.interface samba4
Use 'apt-get autoremove' to remove them.
The following extra packages will be installed:
  suricata
Recommended packages:
  oinkmaster
The following packages will be upgraded:
  suricata
1 upgraded, 0 newly installed, 0 to remove and 342 not upgraded.
3 not fully installed or removed.
Need to get 0 B/785 kB of archives.
After this operation, 1 501 kB disk space will be freed.
Do you want to continue [Y/n]? y
E: Could not open file descriptor -1
debconf: apt-extracttemplates failed: No such file or directory
Setting up grep (2.14-3) ...
(Reading database ... 335809 files and directories currently installed.)
Preparing to replace suricata 1.1.1-1 (using .../suricata_1.4.3-1_amd64.deb) ...
 * NFQUEUE support not found !
 * Please ensure the nfnetlink_queue module is loaded or built in kernel
invoke-rc.d: initscript suricata, action "stop" failed.
dpkg: warning: subprocess old pre-removal script returned error exit status 5
dpkg: trying script from the new package instead ...
 * NFQUEUE support not found !
 * Please ensure the nfnetlink_queue module is loaded or built in kernel
invoke-rc.d: initscript suricata, action "stop" failed.
dpkg: error processing /var/cache/apt/archives/suricata_1.4.3-1_amd64.deb (--unpack):
 subprocess new pre-removal script returned error exit status 5
 * NFQUEUE support not found !
 * Please ensure the nfnetlink_queue module is loaded or built in kernel
invoke-rc.d: initscript suricata, action "start" failed.
dpkg: error while cleaning up:
 subprocess installed post-installation script returned error exit status 5
Errors were encountered while processing:
 /var/cache/apt/archives/suricata_1.4.3-1_amd64.deb
E: Sub-process /usr/bin/dpkg returned an error code (1)


[JPB]

I found a Solution on http://ubuntuforums.org/showthread.php?t=1608698 thanx to  matt_symes

There is a way to manually remove a package from dpkg.
This is assuming you have tried _all_ other methods.
i.e Purging and removing the package from dpkg.

As unless you know what you are doing you can do serious damage. If you want to be sure, it might be worth trying it in a VM first.
And make a backup the /var/lib/dpkg directory. I dont want to break your setup. Use at your own risk. Also i used this under debian.

1. dpkg -P suricata

If this does not work

2. dpkg -L suricata

This will list the files that suricatauses.

Navigate to.

3. /var/lib/dpkg/info

Delete the file.

4. suricata.postrm

Run

5. apt-get remove --purge suricata

Remove all files and directories you found with dpkg -L  <<<---Careful don't delete directories only files!!

Then run

6. apt-get update.

Kind regards.

[jhayam]

Here another solution to this problem, works for me:

Code: [Select]

sudo apt-get remove suricata

Code: [Select]

sudo apt-get purge suricataThis following command move all packages files that contains suricata to /tmp folder:

Code: [Select]

sudo mv /var/lib/dpkg/info/suricata.* /tmp/and this command force to remove the package:

Code: [Select]

sudo dpkg --remove --force-remove-reinstreq suricataafter do

Code: [Select]

sudo apt-get cleanand

Code: [Select]

sudo apt-get updateand now suricata is remove, but i still don't know how to reinstall zentyal-ips after the upgrade from 3.3 to 3.4. Without the problem list above.

Code: [Select]

invoke-rc.d: initscript suricata, action "stop" failed.
dpkg: warning: subprocess old pre-removal script returned error exit status 5
dpkg: trying script from the new package instead ...
 * NFQUEUE support not found !
 * Please ensure the nfnetlink_queue module is loaded or built in kernel
invoke-rc.d: initscript suricata, action "stop" failed.
dpkg: error processing /var/cache/apt/archives/suricata_1.4.3-1_amd64.deb (--unpack):
 subprocess new pre-removal script returned error exit status 5
 * NFQUEUE support not found !
 * Please ensure the nfnetlink_queue module is loaded or built in kernel
invoke-rc.d: initscript suricata, action "start" failed.
dpkg: error while cleaning up:
 subprocess installed post-installation script returned error exit status 5
Errors were encountered while processing:
 /var/cache/apt/archives/suricata_1.4.3-1_amd64.deb
E: Sub-process /usr/bin/dpkg returned an error code (1)


[stovesy]

I struggled with a 'very bad inconsistent state' message regarding suricata.
It was failing do to the package calling /etc/init.d/suricata for starts and stops etc, and that script checking for /proc/net/netfilter/nf_queue, which for some reason fails. The init script then exits with an exit 5, which I think gets the package installer to thinking something bad has happened.

I was unable to to and apt-get upgrade as suricata package was failing to install.

So..
I altered /etc/init.d/suricata as follows

Code: [Select]

check_nfqueue() {
if [ ! -e /proc/net/netfilter/nf_queue ]; then
    log_failure_msg "NFQUEUE support not found !"
    log_failure_msg "Please ensure the nfnetlink_queue module is loaded or built in kernel"
    exit 0
fi
}

Then did...
sudo apt-get install -f
sudo apt-get update
sudo apt-get upgrade
sudo service zentyal restart

[bastolino]

Have a look at this thread: https://forum.zentyal.org/index.php/topic,21530.0.html

[com_gunner]

sudo nano /etc/init.d/suricata
Cambiando la siguiente linea:
if [ ! -e /proc/net/netfilter/nf_queue ]; then
Por:
if [ ! -e /proc/net/netfilter/nfnetlink_queue ]; then

[adymeblack]

I removed a RADIUS module that i wasn't using and it took care of the problem.

[unknown001]

For those of you still having a problem. Not sure if this will help you I had same issue upgrading 3.2.8 to 3.2.11. My solution was, in IDS/IPS disable the interface that IDS/IPS was enable on. Then disable IDS/IPS package/module, then upgraded suricata package worked. 

They did this for security purposes? maybe? Or maybe Suricata will not modify itself while running. Once you updated to the desired version, enable IDS/IPS again.