[ossec-list] Info: Ubuntu: package pre-removal script subprocess returned error exit status 1

[Dorian Fraser-Moore]

Hi,

Apologies if this is a known issue, I've been unable to find any reports.

I have OSSEC installed on a small group of 7 servers running Ubuntu 16.04.5
LTS and 18.04.1 LTS on AMD64, with all current distribution upgrades
applied. Ossec was installed on each of the servers, by hand (no puppet
etc,) following the instructions here:

http://www.ossec.net/downloads.html#apt-automated-installation-on-ubuntu-and-debian

The packages currently installed are:

ossec-hids-agent 3.1.0-5696xenial
ossec-hids-agent 3.1.0-5696bionic
ossec-hids-server 3.1.0-5696bionic

They systems are now all letting me know that an upgrade is available, to
the following versions

ossec-hids-agent 3.1.0-5711xenial
ossec-hids-agent 3.1.0-5711bionic
ossec-hids-server 3.1.0-5711bionic

However when I issue an apt-get upgrade I get the following errors:

*ossec-hids-agent 3.1.0-5711xenial:*

Preparing to unpack .../ossec-hids-agent_3.1.0-5711xenial_amd64.deb ...
prerm called with unknown argument `upgrade'
dpkg: warning: subprocess old pre-removal script returned error exit status
1
dpkg: trying script from the new package instead ...
prerm called with unknown argument `failed-upgrade'
dpkg: error processing archive
/var/cache/apt/archives/ossec-hids-agent_3.1.0-5711xenial_amd64.deb
(--unpack):
subprocess new pre-removal script returned error exit status 1
Errors were encountered while processing:
/var/cache/apt/archives/ossec-hids-agent_3.1.0-5711xenial_amd64.deb
E: Sub-process /usr/bin/dpkg returned an error code (1)

*ossec-hids-agent 3.1.0-5711bionic:*

Preparing to unpack .../ossec-hids-agent_3.1.0-5711bionic_amd64.deb ...
prerm called with unknown argument `upgrade'
dpkg: warning: old ossec-hids-agent package pre-removal script subprocess
returned error exit status 1
dpkg: trying script from the new package instead ...
prerm called with unknown argument `failed-upgrade'
dpkg: error processing archive
/var/cache/apt/archives/ossec-hids-agent_3.1.0-5711bionic_amd64.deb
(--unpack):
new ossec-hids-agent package pre-removal script subprocess returned error
exit status 1
Errors were encountered while processing:
/var/cache/apt/archives/ossec-hids-agent_3.1.0-5711bionic_amd64.deb
E: Sub-process /usr/bin/dpkg returned an error code (1)

*ossec-hids-server 3.1.0-5711bionic:*

Preparing to unpack .../ossec-hids-server_3.1.0-5711bionic_amd64.deb ...
prerm called with unknown argument `upgrade'
dpkg: warning: old ossec-hids-server package pre-removal script subprocess
returned error exit status 1
dpkg: trying script from the new package instead ...
prerm called with unknown argument `failed-upgrade'
dpkg: error processing archive
/var/cache/apt/archives/ossec-hids-server_3.1.0-5711bionic_amd64.deb
(--unpack):
new ossec-hids-server package pre-removal script subprocess returned error
exit status 1
Errors were encountered while processing:
/var/cache/apt/archives/ossec-hids-server_3.1.0-5711bionic_amd64.deb
E: Sub-process /usr/bin/dpkg returned an error code (1)

Doing an, eg, apt-get install -f ossec-hids-server results in a similar
message:

Preparing to unpack .../ossec-hids-server_3.1.0-5711bionic_amd64.deb ...
prerm called with unknown argument `upgrade'
dpkg: warning: old ossec-hids-server package pre-removal script subprocess
returned error exit status 1
dpkg: trying script from the new package instead ...
prerm called with unknown argument `failed-upgrade'
dpkg: error processing archive
/var/cache/apt/archives/ossec-hids-server_3.1.0-5711bionic_amd64.deb
(--unpack):
new ossec-hids-server package pre-removal script subprocess returned error
exit status 1
Errors were encountered while processing:
/var/cache/apt/archives/ossec-hids-server_3.1.0-5711bionic_amd64.deb
E: Sub-process /usr/bin/dpkg returned an error code (1)

As I can see a pattern here across several systems I think the issue is
most likely with the packaging of these versions, rather that my servers
configurations, so I'm posting here in case anyone is aware of these issues
would like to investigate. I've managed to work around the issue by doing
an apt-get remove ossec-hids-agent && apt-get install ossec-hids-agent / apt-get
remove ossec-hids-server && apt-get install ossec-hids-server but in case a
bug has been introduced into the upgrade scripts I thought I'd beset report
this, as it may cause more issues in a managed environment.

Best wishes,

Dorian