With Univention Corporate Server 4.0-5, the fifth point release of Univention Corporate Server (UCS) 4.0 is now available. It provides various improvements and bugfixes especially in the areas of Active Directory compatibility, and UCS management system. All security updates released for UCS 4.0-4 are included in this update.

§Chapter 2. Notes on the update

During the update some services in the domain may not be available, i.e. the update should occur in a maintenance window. It is recommended to test the update in a separate test environment prior to the actual update. The test environment should be identical to the production environment. Depending on the system performance, network connection and the installed software the update takes between 20 minutes and several hours.

§2.1. Recommended update order for environments with more than one UCS server

In environments with more than one UCS system, the update order of the UCS systems must be borne in mind:

The authoritative version of the LDAP directory service is maintained on the master domain controller and replicated on all the remaining LDAP servers of the UCS domain. As changes to the LDAP schemes can occur during release updates, the master domain controller must always be the first system to be updated during a release update.

§2.2. UCS installation DVDs only available for 64 bit

Starting with UCS 4.0 UCS, installation DVDs are only provided for the x86 64 bit architecture (amd64). Existing 32 bit UCS 3 systems can still be updated to UCS 4.0 through the online repository or by using update DVDs. The 32 bit architecture will be supported over the entire UCS 4 maintenance.

§Chapter 3. Preparation of update

It must be checked whether sufficient disk space is available. A standard installation requires a minimum of 6 GB of disk space. Depending on the scope of the existing installation, the update will require about another 2 GB of disk space for downloading and installing all packages.

For the update, a login should be performed on the system's local console as user root, and the update should be initiated there. Alternatively, the update can be conducted using Univention Management Console.

Remote updating via SSH is not recommended as this may result in the update procedure being cancelled, e.g., if the network connection is interrupted. In consequence, this can affect the system severely. If updating should occur over a network connection nevertheless, it must be verified that the update continues despite disconnection from the network. This can be done, e.g., using the tools screen and at. These tools are installed on all system roles by default.

§Chapter 4. Postprocessing of the update

Following the update, new or updated join scripts need to be executed. This can be done in two ways: Either using the UMC module Domain join or by running the command univention-run-join-scripts as user root.

Subsequently the UCS system needs to be restarted.

§Chapter 5. Further notes on selected packages

§5.1. Collection of usage statistics

Anonymous usage statistics on the use of Univention Management Console are collected when using the UCS Core Edition version of UCS (which is generally used for evaluating UCS). The modules opened are logged in an instance of the web traffic analysis tool Piwik. This makes it possible for Univention to tailor the development of Univention Management Console better to customer needs and carry out usability improvements.

This logging is only performed when the UCS Core Edition license is used. The license status can be verified via the menu entry License -> License information of the user menu in the upper right corner of Univention Management Console. If UCS Core Edition is listed under License type, this version is in use. When a regular UCS license is used, no usage statistics are collected.

Independent of the license used, the statistics generation can be deactivated by setting the Univention Configuration Registry variable umc/web/piwik to false.

§5.2. Scope of security support for WebKit, Konqueror and QtWebKit

WebKit, Konqueror and QtWebKit are shipped in the maintained branch of the UCS repository, but not covered with security support. WebKit is primarily used for displaying HTML help pages etc. Firefox should be used as web browser.

§5.3. Recommended browsers for the access to Univention Management Console

Univention Management Console uses numerous JavaScript and CSS functions to display the web interface. Cookies need to be permitted in the browser. The following browsers are recommended:

Chrome as of version 33
Firefox as of version 24
Internet Explorer as of version 9
Safari and Safari Mobile as of version 7

Users with older browsers may experience display or performance problems.

§Chapter 6. Changelog

Listed are the changes since UCS 4.0-4:

§6.1. General

All security updates issued for UCS 4.0-4 are included:

§6.2. Basic system services

§6.2.1. Linux kernel and firmware packages

The Linux kernel has been updated to 3.16.7-ckt20. It provides many bugfixes and fixes several vulnerabilities (Bug 38764).

§6.2.2. Boot Loader

Two new Univention Configuration Registry variable grub/default and grub/savedefault are added, which allow the selection of the next kernel to boot (Bug 40509).

§6.3. Domain services

§6.3.1. OpenLDAP

The group access for the LDAPI socket interface has been removed (Bug 39812).

§6.3.1.1. Listener/Notifier domain replication

The flushing of the listener cache has been disabled during module initialization (Bug 39958).
Some replicated objects were not deleted, when the LDAP server closed its side of the LDAP connection. This issue has been fixed (Bug 40066).
The timeout for the initial LDAP search during domain join has been increased to two hours, as joining in a large domain can take much longer than the default five minutes. The time can be changed through the Univention Configuration Registry variable listener/timeout/scans (Bug 40230).

§6.3.1.2. DNS server

The Univention Configuration variables dns/nameserver/registration/forward_zone and dns/nameserver/registration/reverse_zone have been added that allow to disable the automatic registration as additional nameserver (Bug 39384).

§6.4. Univention Management Console

§6.4.1. Univention Management Console web interface

The expiration date has been increased by 5 years. This results in a traceback during the login on the 29th of February. This issue has been fixed (Bug 40791).

§6.4.2. Mail

Domain names for mail domains are now lowercased (Bug 40108).

§6.5. System services

§6.5.1. Mail services

A bug in the mailing list filter policy server allowed senders with an empty email address to send to restricted mailing lists. This issue has been fixed (Bug 40352).
An error in the dovecot listener could lead to the unintended deletion of a shared folder if the corresponding LDAP objects was changed. This issue has been fixed (Bug 40018).
The UMC permissions write and all for shared folders did not contain the IMAP permission for expunge. A removal of mails or moving mails was not possible. This problem has been fixed and the permission will be updated automatically if the join script of univention-mail-dovecot is called (Bug 40037).
A problem regarding IMAP ACLs at shared folders with primary mail address has been fixed. ACLs that have been removed via Univention Management Console or CLI have not been removed on the IMAP server (Bug 40195).
A file for the process of handling user renames has been moved to a secure location (Bug 40583, Bug 40584).

§6.5.2. Proxy services

This update adds the possibility to define the number of squid's rewrite helper processes via the new Univention Configuration Registry variable squid/rewrite/children (Bug 40094).
A new configuration option dbtemp has been added that specifies a directory for temporary backing files of squidGuard's in-memory databases (Bug 40593).

§6.6. Virtualization

§6.6.1. Univention Virtual Machine Manager (UVMM)

Some unused helper code has been removed to fix an import error of the Python libvirt module from the UVMM Univention Directory Listener module handling the dynamic addition and removal of virtualization hosts (Bug 40255).

§6.7. Services for Windows

§6.7.1. Samba

The ACL check in the SYSVOL sync script is now limited to the Policies directory (Bug 40267).
There are two new Univention Configuration Registry variables samba4/sysvol/sync/from_upstream and samba4/sysvol/sync/from_downstream which can be used to deactivate copying files from other domain controllers (Bug 40314).
The SYSVOL sync script now checks if any changes need to be synchronized at all and it uses file locking to coordinate concurrent read and write processes (Bug 40346).
On UCS@school Samba AD DC Slaves the univention-samba4 joinscript could take a long time to wait in vain for an object to get synchronized to the DC Master (Bug 40387).

§6.7.2. Univention S4 Connector

The synchronization failed if a removed user was recreated at a different position. This issue has been fixed (Bug 40234).
The new package univention-nagios-s4-connector provides a Nagios plugin to check the state of the Univention S4 Connector (Bug 40345).
msPrint-ConnectionPolicy objects are now synced if the Univention Configuration Registry variable connector/s4/mapping/msprintconnectionpolicy is set to true. The Univention S4 Connector has to be restarted after changing this variable). This is required for UCS@school and will be set there accordingly (Bug 40299, Bug 40466).
Univention S4 Connector was still running during re-joins. This issue has been fixed (Bug 40389).
Wildcard DNS records didn't get synchronized any more. This issue has been fixed (Bug 40381).

§6.8. Other changes

The package lksctp-tools has been added as a new dependency of OpenJDK-7 (Bug 40042).