UCS 4.3 Release Notes

Release notes for the installation and update of Univention Corporate Server (UCS) 4.3-1

Table of Contents

1. Release Highlights
2. Notes about the update
2.1. Recommended update order for environments with more than one UCS server
2.2. UCS installation DVD only available for 64 bit
3. Preparation of update
4. Postprocessing of the update
5. Notes on selected packages
5.1. Collection of usage statistics
5.2. Scope of security support for WebKit, Konqueror and QtWebKit
5.3. Recommended browsers for the access to Univention Management Console
6. Changelog
6.1. General
6.2. Basic system services
6.2.1. Univention Configuration Registry
6.2.1.1. Changes to templates and modules
6.3. Domain services
6.3.1. OpenLDAP
6.3.1.1. Listener/Notifier domain replication
6.3.2. DNS server
6.4. Univention Management Console
6.4.1. Univention Portal
6.4.2. Univention Management Console server
6.4.3. Univention App Center
6.4.4. Univention Directory Manager UMC modules and command line interface
6.4.5. Modules for system settings / setup wizard
6.4.6. Domain join module
6.4.7. License module
6.4.8. System diagnostic module
6.4.9. Other modules
6.5. Univention base libraries
6.6. Software deployment
6.7. System services
6.7.1. SAML
6.7.2. Dovecot
6.7.3. Postfix
6.7.4. Printing services
6.7.5. Nagios
6.7.6. Apache
6.7.7. Proxy services
6.7.8. Kerberos
6.7.9. SSL
6.7.10. DHCP server
6.7.11. NFS
6.8. Desktop
6.9. Container Technologies
6.10. Services for Windows
6.10.1. Samba
6.10.2. Univention S4 Connector
6.10.3. Univention Active Directory Connection
6.11. Other changes

§Chapter 1. Release Highlights

With Univention Corporate Server 4.3-1, the first point release of Univention Corporate Server (UCS) 4.3 is now available. It provides several feature improvements and extensions, new properties as well as various improvements and bugfixes. Here is an overview of the most important changes:

  • The UMC system diagnostic module has been extended with additional tests. They support the administrator to check the system health of the UCS system and the whole domain.

  • The management system usability and configurability has been expanded. The expected usability has been improved in several places, for example when configuring email addresses or DNS settings.

  • A content-security-policy has been integrated in the UCS management system to increase the browser security by protecting web cookies.

  • Various security updates have been integrated into UCS 4.3-1, e.g. Apache2, the Linux kernel and Samba4. A complete list is available in Chapter 6.

§Chapter 2. Notes about the update

During the update some services in the domain may not be available temporarily, that is why the update should occur in a maintenance window. It is recommended to test the update in a separate test environment prior to the actual update. The test environment should be identical to the production environment. Depending on the system performance, network connection and the installed software the update will take between 20 minutes and several hours.

§2.1. Recommended update order for environments with more than one UCS server

In environments with more than one UCS system, the update order of the UCS systems must be borne in mind:

The authoritative version of the LDAP directory service is maintained on the master domain controller and replicated to all the remaining LDAP servers of the UCS domain. As changes to the LDAP schema can occur during release updates, the master domain controller must always be the first system to be updated during a release update.

§2.2. UCS installation DVD only available for 64 bit

Starting with UCS 4.0, installation DVD are only provided for the x86 64 bit architecture (amd64). Existing 32 bit UCS 3 systems can still be updated to UCS 4.0 through the online repository or by using update DVD. The 32 bit architecture will be supported over the entire UCS 4 maintenance period.

§Chapter 3. Preparation of update

It must be checked whether sufficient disk space is available. A standard installation requires a minimum of 6 GB of disk space. Depending on the scope of the existing installation, the update will require about another 2 GB of disk space for download and installation all packages.

For the update, a login should be performed on the system's local console as user root, and the update should be initiated there. Alternatively, the update can be conducted using Univention Management Console.

Remote updating via SSH is not recommended as this may result in the update procedure being canceled, e.g., if the network connection is interrupted. In consequence, this can affect the system severely. If updating should occur over a network connection nevertheless, it must be verified that the update continues in case of disconnection from the network. This can be achieved, e.g., using the tools screen and at. These tools are installed on all UCS system roles by default.

§Chapter 4. Postprocessing of the update

Following the update, new or updated join scripts need to be executed. This can be done in two ways: Either using the UMC module Domain join or by running the command univention-run-join-scripts as user root.

Subsequently the UCS system needs to be restarted.

§Chapter 5. Notes on selected packages

§5.1. Collection of usage statistics

Anonymous usage statistics on the use of Univention Management Console are collected when using the UCS Core Edition. The modules opened get logged to an instance of the web traffic analysis tool Piwik. This makes it possible for Univention to tailor the development of Univention Management Console better to customer needs and carry out usability improvements.

This logging is only performed when the UCS Core Edition license is used. The license status can be verified via the menu entry License -> License information of the user menu in the upper right corner of Univention Management Console. If UCS Core Edition is listed under License type, this version is in use. When a regular UCS license is used, no usage statistics are collected.

Independent of the license used, the statistics generation can be deactivated by setting the Univention Configuration Registry variable umc/web/piwik to false.

§5.2. Scope of security support for WebKit, Konqueror and QtWebKit

WebKit, Konqueror and QtWebKit are shipped in the maintained branch of the UCS repository, but not covered by security support. WebKit is primarily used for displaying HTML help pages etc. Firefox should be used as web browser.

§5.3. Recommended browsers for the access to Univention Management Console

Univention Management Console uses numerous JavaScript and CSS functions to display the web interface. Cookies need to be permitted in the browser. The following browsers are recommended:

  • Chrome as of version 37

  • Firefox as of version 38

  • Internet Explorer as of version 11

  • Safari and Safari Mobile as of version 9

Users running older browsers may experience display or performance issues.

§Chapter 6. Changelog

Listed are the changes since UCS 4.3-0:

§6.1. General

§6.2. Basic system services

§6.2.1. Univention Configuration Registry

§6.2.1.1. Changes to templates and modules

  • The SplitMode setting of systemd-journald can now be set with the Univention Configuration Registry variable systemd/journald/SplitMode (Bug 46279).
  • Fix the template for the Univention Configuration Registry variable update/secure_apt (Bug 45950).

§6.3. Domain services

§6.3.1. OpenLDAP

§6.3.1.1. Listener/Notifier domain replication

  • Very large LDAP schema definitions could prevent the LDAP server on backup and slave systems from starting. The fix ensures that such schemas are handled correctly (Bug 46747).

§6.3.2. DNS server

  • There was a traceback in the join.log file (Bug 46206).
  • The BIND9 service was sometimes not started by the join script (Bug 46206).

§6.4. Univention Management Console

§6.4.1. Univention Portal

  • A Content-Security-Policy has been added to the portal and server overview sites (Bug 45423).

§6.4.2. Univention Management Console server

  • The link in the welcome dialog for sending feedback pointed to a wrong location in the French translation (Bug 45874).
  • The description of the Univention Configuration Registry variable umc/web/piwik has been adjusted to better reflect the actual behavior (Bug 46791).
  • Enhance logging for disabled memberof overlay (Bug 46476).
  • The password dialog that is shown upfront some functions in UMC when using a Single Sign On (SAML) session can now be submitted by pressing Enter (Bug 46735).
  • Fix umc-server executable permissions when updating the package during system setup (Bug 46847).
  • A link pointing to the Univention Privacy Policy has been added to the UCS activation process (Bug 46742).
  • The deprecated child-src directive has been removed from the Content-Security-Policy (Bug 45599).

§6.4.3. Univention App Center

  • Fixed permissions of cache directory (Bug 47094).
  • Categories were not translated (Bug 47072).
  • The deprecated AppManager class is not used anymore in the code (Bug 44542).
  • univention-app update now accepts --cache-dir to use a different directory for downloaded meta files (Bug 47021).
  • When changing the App Center server, update all installed Apps, too (Bug 43434).
  • Join script now uses --bindpwdfile options (Bug 47051).
  • Added update-certificates command to univention-appcenter (Bug 46789).
  • File permissions for /etc/machine.secret in app containers have been fixed (Bug 46823).
  • The Univention Configuration Registry variables ldap/base and ldap/server/* are passed to Docker Apps (Bug 46779).
  • The data directory is no longer moved to the backup directory during the uninstallation of an App (Bug 45670).
  • When the meta data of an App pointed to a setup script but it was missing, an error occurred (Bug 46752).
  • A text referring to the activation of UCS has been updated (Bug 46742).
  • Calling univention-upgrade non-interactively may have caused an error while upgrading Apps when run on a master domain controller (Bug 46684).
  • While updating from UCS 4.2 to UCS 4.3, some Apps changed their version. This requires a re-registration of the Apps (Bug 46440).
  • The development tools did not prepend http:// to the call for zsyncmake (Bug 45830).
  • The App Center cache is now updated locally when the package univention-management-console-appcenter is installed during system setup. (Bug 46813).

§6.4.4. Univention Directory Manager UMC modules and command line interface

  • Whether the simple or advanced search is shown upon opening a Univention Directory Manager module can now be defined via the Univention Configuration Registry variable directory/manager/web/modules/search/advanced_on_open (Bug 46910).
  • Fixed a typo in the German translation of the Release Policy (Bug 46348).
  • Prevent the removal of groups that are mentioned in the settings/default object. These groups are used for new objects and therefore must exist (Bug 44685).
  • Join script uses --bindpwdfile option, added --bindpwdfile support in univention-dnsedit (Bug 47052).
  • Properties that have been set to default values are no longer ignored when saving from the UDM detail page (Bug 46529).
  • Every installation of a Docker Apps adds one machine account. These do not count against the license anymore (Bug 41372).
  • The App opsi does add system users during the installation. These do not count against the license anymore (Bug 46334).
  • DNS entries on Computers are no longer allowed to have an empty forward or reverse zone. Setting it empty led to tracebacks (Bug 44389).
  • The email field in the Contacts tab of a user no longer has its value pre-filled with the value of the mailPrimaryAddress field. As the pre-filled value was not saved to LDAP, this led to undesired inconsistencies in the display of the actual data (Bug 45581).

§6.4.5. Modules for system settings / setup wizard

  • Ignore link local addresses in the Univention Management Console IP change module (Bug 41052).
  • The privacy statement is now displayed directly in the Univention System Setup wizard (Bug 46852).
  • The syntax check for the Hostname of the master domain controller field on the Domain join information page in the Univention System Setup has been changed to FQDN (IP addresses are no longer valid) (Bug 43276).
  • A link pointing to the Univention Privacy Policy has been added to the UCS activation process (Bug 46742).

§6.4.6. Domain join module

  • Added support for --bindpwdfile during join (Bug 47064).
  • Added a link to the knowledge base article about join problems in the join error message (Bug 45514).
  • An error when joining a backup domain controller via the Univention Management Console has been resolved (Bug 42986).
  • New join script keywords have been added to influence the parameters a join script is called with (Bug 46842).
  • The join tools now check if the join status file is a proper text file (Bug 46731).
  • The binddn of the master domain controller Account is determined in a more robust way (Bug 36097).

§6.4.7. License module

  • A link pointing to the Univention Privacy Policy has been added to the UCS activation process (Bug 46742).

§6.4.8. System diagnostic module

  • A new diagnostic plugin has been added to check whether the remote and the local version of the SAML identity and service certificates match (Bug 45515).
  • The ssh test does not fail anymore for computer objects that are not (Bug 43403).
  • Links to knowledge base articles now point to the correct addresses (Bug 46166).
  • Avoid paramiko log messages winding up in connector-s4.log (Bug 46708).
  • Only use FQDNs for the SSH connection checks (Bug 45370).
  • The output of actions is logged (Bug 46039).
  • Run nsupdate check only on Samba or Samba4 systems (Bug 45904).
  • The German name of the module was adjusted (Bug 46034).
  • Sometimes the 01_ssh_connection check was hanging (Bug 45343).
  • nsupdate checks in UCS@school did not use the Slave PDCs (Bug 45584).
  • Check of the file system permissions of local mail directory has been added (Bug 46677).

§6.4.9. Other modules

  • Whether the simple or advanced search is shown upon opening a UDM module can now be defined via the Univention Configuration Registry variable directory/manager/web/modules/search/advanced_on_open (Bug 46910).
  • The server count is no longer shown in the license information dialog because of confusion with the number of physical and virtual servers (Bug 45944).
  • Properties that have been set to default values are no longer ignored when saving from the UDM detail page (Bug 46529).
  • Fixed referencing objects not always being shown in the policies module (Bug 38674).
  • The type and position of an UDM object are displayed again on the detail page (Bug 46371).

§6.5. Univention base libraries

  • The LDAP syntax for userPrimaryGroupPreset has been changed to DirectoryString (Bug 46288).
  • Added support for --bindpwdfile during join (Bug 47066).
  • Improve error logging and retry AD LDAP bind in case of ldap.OPERATIONS_ERROR during first LDAP search (Bug 41733).
  • A problem when simultaneously registering LDAP ACL and schema extension has been fixed (Bug 45033).
  • Improve debug output in lib.admember.lookup_adds_dc() (Bug 44478).
  • An error message when joining an AD domain was not printed correctly because a variable was used before its assignment (Bug 45967).

§6.6. Software deployment

  • Fixed a typo when warning about an outdated UCS version (Bug 47097).
  • Make sure all services that are disabled while installing package updates are running at the end of the update by starting them explicitly (Bug 47029).
  • The update from 4.2 to 4.3 is now stopped if a failed.ldif is found (Bug 46850).
  • Fix the path to the dpkg-statoverride tool which is called during system setup (Bug 46847).
  • Links to knowledge base articles now point to the correct addresses (Bug 46166).

§6.7. System services

§6.7.1. SAML

§6.7.2. Dovecot

  • When moving a user's mailbox to a different filesystem, set owner and group for all files on the target filesystem (Bug 46892).

§6.7.3. Postfix

  • When upgrading from a system that previously used Cyrus, the now deprecated mail quota policies can be removed using the script /usr/share/univention-mail-postfix/remove_mail_quota_policy (Bug 46454).

§6.7.4. Printing services

  • Added support for --bindpwdfile during join (Bug 47062).

§6.7.5. Nagios

  • Fixed permissions for Nagios log file (Bug 47015).

§6.7.6. Apache

  • Added headers X-Forwarded-Proto and X-Forwarded-SSL so that certain Apps work correctly behind a proxy (Bug 44921).

§6.7.7. Proxy services

  • Added support for --bindpwdfile during join (Bug 47058).
  • Fix warning during squid configuration reload (Bug 46565).
  • Remove obsolete hierarchy_stoplist directive (Bug 46567).
  • A wrapper is added to support non ASCII characters in passwords with basic authentication. Previously non ASCII characters did not work with IE (Bug 34154).

§6.7.8. Kerberos

  • Added support for --bindpwdfile during join (Bug 47070).
  • Join script does not need credentials and added --bindpwdfile parameter to salt_krb5Keys (Bug 46842).

§6.7.9. SSL

  • Fixed handling of expired certificates (Bug 45472).
  • Renewed certificates were not readable by backup domain controller (Bug 46203).

§6.7.10. DHCP server

  • Added support for --bindpwdfile during join (Bug 47065).

§6.7.11. NFS

  • Mask the service rpc-svcgssd for handling Kerberos tickets for NFS (Bug 46587).

§6.8. Desktop

  • Help the user decide which user to log in as at the KDE login screen (Bug 47026).

§6.9. Container Technologies

  • univention-system-setup has been removed from the list of packages to be installed along with univention-container-role-common. This role is used for Docker Apps and does not need univention-system-setup (Bug 45909).

§6.10. Services for Windows

§6.10.1. Samba

  • Added support for --bindpwdfile during join (Bug 47060, Bug 47059).
  • Adjust firewall to Samba 4.7 dynamic port range (Bug 46809).
  • Added a more detailed error message for the domain join (Bug 43223).
  • Locking in the sysvol-sync.sh has been fixed (Bug 46486).
  • A dependency to UCS@school in the univention-samba join script has been removed (Bug 46006).

§6.10.2. Univention S4 Connector

  • When objects are deleted or moved remove the their DN from both group member mapping caches. This affected UCS@school (Bug 46682).
  • Added support for option --bindpwdfile during join (Bug 47061).
  • The Univention Directory Listener module now restarts the connector if extended attributes are modified (Bug 46972).
  • Rejects for non-ASCII Samba/AD accounts are not handled properly due to sqlite encoding problem (Bug 47013).
  • In case Univention Configuration Registry variable connector/s4/mapping/group/syncmode is set to write, the S4-Connector would still modify groups in OpenLDAP when a user was modified. This affected UCS@school (Bug 46682).
  • Preserve case in DN during move sync from ucs to samba (Bug 46741).
  • connector-tracebacks.log is not written any longer (Bug 46798).
  • A mismatch between the samba and OpenLDAP SID for the host object after the connector initialization in UCS@school has been fixed (Bug 40419).

§6.10.3. Univention Active Directory Connection

  • Added support for --bindpwdfile during join (Bug 47096).
  • Improve error feedback for connectionFailed and failedADConnect exceptions (Bug 47091).
  • Some encoding in the context of rejects have been fixed (Bug 45779).
  • Update shadowMax, shadowLastChange and krb5PasswordEnd during password sync from AD to UCS, too (Bug 45760).
  • Output exception details in check_domain and admember_join (Bug 44478).

§6.11. Other changes

  • Fixed a typo when warning about an outdated UCS version (Bug 47097).
  • The link in the welcome dialog for sending feedback pointed to a wrong location in the French translation (Bug 45874).
  • Properly transition system jobs to system_cronjob_t SELinux context and stop relying on refpolicy specific identifiers (Bug 46629).
  • Ignore loop-back network interfaces lo and docker0 in univention-register-network-address (Bug 41052).
  • If more than one hard disk drive is detected during UCS installation, the target disk for the grub installer can be selected. (Bug 44595).
  • The univention-updater preup and postup scripts have been adapted for UCS 4.3-1. (Bug 47121).
  • The following packages were moved to the maintained repository: gunicorn python-backports-abc python-django python-django-celery python-django-common python-djangorestframework python-djangorestframework-doc python-gunicorn python-pampy. (Bug 46585).