apt-get purge portmap

Question

i had rpc.statd open on port 111 on a relatively fresh install of debian squeeze. i did an apt-get purge portmap as i wanted to disable rpc services and close the open port on my box; i was presented with the following:

Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages were automatically installed and are no longer required:
  libtirpc1 rpcbind
Use 'apt-get autoremove' to remove them.
The following extra packages will be installed:
  libtirpc1 rpcbind
The following packages will be REMOVED:
  nfs-common* portmap*
The following NEW packages will be installed:
  libtirpc1 rpcbind
0 upgraded, 2 newly installed, 2 to remove and 0 not upgraded.
Need to get 127 kB of archives.
After this operation, 438 kB disk space will be freed.
Do you want to continue [Y/n]? n

long story short, i was able to remove portmap, without installing additional packages, by first doing apt-get purge nfs-common followed by apt-get purge portmap.

can anyone explain this behaviour? why would apt-get attempt to install rpcbind and libtirpc1 when attempting to purge portmap in the first case, but not the second? from the output above, it is clear that apt-get intended to remove nfs-common along with portmap to begin with. the only other relevant detail i was able to find is that fam depends on portmap, but this is a remote server and fam and a gui are not needed. is this a bug or am i missing something? if so, who should the report be directed towards?

Solution 1

APT is designed to not leave you a broken system. It has no idea that you are running a server, and don't need some package or the other.

You will see behavior like this when trying to remove a package if some other package depends on what you are trying to remove, but can also use another package instead. When you try to remove the package it depends on APT will offer to install the alternative.

You will see this frequently if you try to purge a mail transfer agent (mail server). There are a large number of programs which require a MTA, so when you try to purge exim or postfix the other will be installed.

Solution 2

Just do the following in /etc/default/portmap to stop portmap from listening on the external interface:

# If you want portmap to listen only to the loopback
# interface, uncomment the following line (it will be
# uncommented automatically if you configure this
# through debconf).
OPTIONS="-i 127.0.0.1"

Then do:

/etc/init.d/portmap restart

I think the problem is quite simple, but tricky. Apt does install rpcbind because you remove portmap From your output:

The following extra packages will be installed:
libtirpc1 rpcbind

But then it also notices that rpcbind is not necessary anymore because nfs-common is going to be removed also. From your output:

The following packages were automatically installed and are no longer required:
libtirpc1 rpcbind
Use 'apt-get autoremove' to remove them.

If you would have answered "y" then apt would have removed portmap and nfs-common, and installed libtirpc1 and rpcbind. Then you would have run apt-get autoremove to remove libtirpc1 and rpcbind.

I think it may be something in the order of importance in apt's decision making process.

I.e. the rule: portmap removed, then install rpcbind

Is of more importance than the rule: nfs-common removed so I don't need rpcbind

The first rule may be checked without knowledge yet of nfs-common being removed. It's less important that a package is not needed anymore than that a dependency has been broken. And it's easily "fixed" by running "apt-get autoremove" afterwards.

I don't think it's a bug, just a result of apt's decision making process.

Comments

[obsd]

agreed, but the behaviour doesn't seem logical. it appears to me that in my original attempt to purge portmap apt-get is trying to provide dependencies for nfs-common (portmap is provided in rpcbind as a virtual package, and rpcbind depends on libtirpc1). This is unnecessary, however, as apt-get is removing nfs-common per the output. Explicitly removing nfs-common and then removing portmap does not yield any complaints from apt. fam does depend on portmap; why is apt complaining in the first case, but the second? as far as i can tell, fam is unnecessary unless you are utilizing rpc services.

[obsd]

i appreciate your response, though I am already aware of how to disable service. my question is about the inconsistent behaviour of apt-get in processing the purge portmap command. see above for details.

[aseq]

Yeah I understand. I figured I suggest it in case someone would find it useful.It's not always obvious how to change it and it's one of those things you want to do unless you need portmap to be listening on anything but the localhost.