UCS 4.3 Release Notes

Release notes for the installation and update of Univention Corporate Server (UCS) 4.3-3

Table of Contents

1. Release Highlights
2. Notes about the update
2.1. Recommended update order for environments with more than one UCS server
2.2. UCS installation DVD only available for 64 bit
3. Preparation of update
4. Postprocessing of the update
5. Notes on selected packages
5.1. Collection of usage statistics
5.2. Scope of security support for WebKit, Konqueror and QtWebKit
5.3. Recommended browsers for the access to Univention Management Console
6. Changelog
6.1. General
6.2. Univention Installer
6.3. Basic system services
6.3.1. Univention Configuration Registry
6.3.1.1. Changes to templates and modules
6.4. Domain services
6.4.1. OpenLDAP
6.4.1.1. Listener/Notifier domain replication
6.5. Univention Management Console
6.5.1. Univention Management Console web interface
6.5.2. Univention Portal
6.5.3. Univention Management Console server
6.5.4. Univention App Center
6.5.5. Univention Directory Manager UMC modules and command line interface
6.5.6. Modules for system settings / setup wizard
6.5.7. Domain join module
6.5.8. System diagnostic module
6.5.9. Policies
6.5.10. Filesystem quota module
6.5.11. Other modules
6.6. Univention base libraries
6.7. Software deployment
6.8. System services
6.8.1. PostgreSQL
6.8.2. Docker
6.8.3. SAML
6.8.4. Univention self service
6.8.5. Mail services
6.8.6. Dovecot
6.8.7. Printing services
6.8.8. Nagios
6.8.9. RADIUS
6.8.10. Proxy services
6.8.11. SSL
6.9. Virtualization
6.9.1. UCS Virtual Machine Manager (UVMM)
6.10. Services for Windows
6.10.1. Samba
6.10.2. Univention S4 Connector
6.10.3. Univention Active Directory Connection
6.11. Other changes

§Chapter 1. Release Highlights

With Univention Corporate Server 4.3-3, the third point release of Univention Corporate Server (UCS) 4.3 is now available. It provides several feature improvements and extensions, new properties as well as various improvements and bugfixes. Here is an overview of the most important changes:

  • The configuration options for the UCS portal have been extended to better adapt it to your own needs. It is now possible to define custom categories for tiles. There also is the possibility to define static links, e.g. to link an imprint.

  • The new UCS Dashboard App allows administrators to quickly and easily view the state of the domain or individual servers on different dashboards.

  • In addition to minor bug fixes in Univention Management Console the scrolling behavior has been improved in many places.

  • The introduction of a new simplified Python API reduces the development effort for developers to access the UCS Identity Management.

  • Various security updates have been integrated into UCS 4.3-3, e.g. Apache2, the Linux kernel and Samba4. UCS 4.3-3 is based on the Debian release 9.6 released in November. A complete list is available in Chapter 6.

§Chapter 2. Notes about the update

During the update some services in the domain may not be available temporarily, that is why the update should occur in a maintenance window. It is recommended to test the update in a separate test environment prior to the actual update. The test environment should be identical to the production environment. Depending on the system performance, network connection and the installed software the update will take between 20 minutes and several hours.

§2.1. Recommended update order for environments with more than one UCS server

In environments with more than one UCS system, the update order of the UCS systems must be borne in mind:

The authoritative version of the LDAP directory service is maintained on the master domain controller and replicated to all the remaining LDAP servers of the UCS domain. As changes to the LDAP schema can occur during release updates, the master domain controller must always be the first system to be updated during a release update.

§2.2. UCS installation DVD only available for 64 bit

Starting with UCS 4.0, installation DVD are only provided for the x86 64 bit architecture (amd64). Existing 32 bit UCS 3 systems can still be updated to UCS 4.0 through the online repository or by using update DVD. The 32 bit architecture will be supported over the entire UCS 4 maintenance period.

§Chapter 3. Preparation of update

It must be checked whether sufficient disk space is available. A standard installation requires a minimum of 10 GB of disk space. The update requires approximately 4 GB additional disk space to download and install the packages, depending on the size of the existing installation.

For the update, a login should be performed on the system's local console as user root, and the update should be initiated there. Alternatively, the update can be conducted using Univention Management Console.

Remote updating via SSH is not recommended as this may result in the update procedure being canceled, e.g., if the network connection is interrupted. In consequence, this can affect the system severely. If updating should occur over a network connection nevertheless, it must be verified that the update continues in case of disconnection from the network. This can be achieved, e.g., using the tools screen and at. These tools are installed on all UCS system roles by default.

§Chapter 4. Postprocessing of the update

Following the update, new or updated join scripts need to be executed. This can be done in two ways: Either using the UMC module Domain join or by running the command univention-run-join-scripts as user root.

Subsequently the UCS system needs to be restarted.

§Chapter 5. Notes on selected packages

§5.1. Collection of usage statistics

Anonymous usage statistics on the use of Univention Management Console are collected when using the UCS Core Edition. The modules opened get logged to an instance of the web traffic analysis tool Piwik. This makes it possible for Univention to tailor the development of Univention Management Console better to customer needs and carry out usability improvements.

This logging is only performed when the UCS Core Edition license is used. The license status can be verified via the menu entry License -> License information of the user menu in the upper right corner of Univention Management Console. If UCS Core Edition is listed under License type, this version is in use. When a regular UCS license is used, no usage statistics are collected.

Independent of the license used, the statistics generation can be deactivated by setting the Univention Configuration Registry variable umc/web/piwik to false.

§5.2. Scope of security support for WebKit, Konqueror and QtWebKit

WebKit, Konqueror and QtWebKit are shipped in the maintained branch of the UCS repository, but not covered by security support. WebKit is primarily used for displaying HTML help pages etc. Firefox should be used as web browser.

§5.3. Recommended browsers for the access to Univention Management Console

Univention Management Console uses numerous JavaScript and CSS functions to display the web interface. Cookies need to be permitted in the browser. The following browsers are recommended:

  • Chrome as of version 37

  • Firefox as of version 38

  • Internet Explorer as of version 11

  • Safari and Safari Mobile as of version 9

Users running older browsers may experience display or performance issues.

§Chapter 6. Changelog

Listed are the changes since UCS 4.3-2:

§6.1. General

§6.2. Univention Installer

  • The UCS DVD now contains the package netcat-openbsd. It is required for VNC access to virtual machines (Bug 48015).
  • If UCS is installed from an USB stick, grub-install shows a screen to select the boot device. That list no longer includes the USB stick itself (Bug 47925).

§6.3. Basic system services

§6.3.1. Univention Configuration Registry

  • Univention Configuration Registry modules cannot accidentally get registered multiple times anymore (Bug 35239).

§6.3.1.1. Changes to templates and modules

  • Ensure that the address associated with the network interface specified via the Univention Configuration Registry variable interfaces/primary is the first entry in /etc/hosts (Bug 30397).
  • Ensure that the directory /var/univention-backup/ exists in univention-config-registry-backup (Bug 47336).

§6.4. Domain services

§6.4.1. OpenLDAP

§6.4.1.1. Listener/Notifier domain replication

  • The Univention Directory Listener opens two connections: a persistent connection to a Univention Directory Notifier and an on-demand connection to an LDAP server. In some rare situations two different hosts were contacted for those connections, which could lead to inconsistencies in LDAP replication (Bug 48030).
  • Fix terminal detection code in univention-directory-listener-ctrl (Bug 47870).
  • Log a message when a listener module using the new API was deactivated (Bug 47871).
  • Fixed a crash when the Univention Configuration Registry variables server/role and ldap/master are not set (Bug 47837).
  • An alternative mechanism to initialize the Univention Directory Listener in large environments was added (Bug 47783).

§6.5. Univention Management Console

§6.5.1. Univention Management Console web interface

  • A widget for limited text input has been moved to the common library (Bug 48106).
  • Long item names in the tree widget no longer overlap underlying items (Bug 45323).
  • The version of the dojo framework has been upgraded (Bug 47997).
  • The scrolling in the UCS Virtual Machine Manager module has been improved (Bug 36624).
  • The scrolling in the LDAP directory module has been improved (Bug 45598).
  • It is now possible to define custom categories for the portal (Bug 47243).
  • An issue with the drop-down menu for the search value in the advanced search of UDM modules being unusable has been resolved (Bug 44471).

§6.5.2. Univention Portal

  • The ordering of the default categories in the Portal unintentionally changed with a previous update. This has been reverted (Bug 47872).
  • Fix the broken text of the portal title and name (Bug 47877).
  • Portal entries not shown after update to latest portal version (Bug 47870).
  • Portal entries were not shown after the update to erratum 250 (Bug 47864).
  • The visibility of a portal entry object can now be restricted to multiple groups instead of just one (Bug 46927).
  • It is now possible to define custom categories for the portal (Bug 47243).
  • Allow to customize portal with static pages (Bug 43442).

§6.5.3. Univention Management Console server

  • Fix SAML metadata creation for external certificate authorities like Let's Encrypt (Bug 47700).
  • The scrolling in the UCS Virtual Machine Manager module has been improved (Bug 36624).
  • The scrolling in the LDAP directory module has been improved (Bug 45598).
  • Fix regression in traceback handling (Bug 47857).

§6.5.4. Univention App Center

  • Improved check for database existence when installing an app which uses a database (Bug 42690).
  • Checkboxes in the App Settings were marked as required in the HTML causing problems when submitting the form (Bug 47824).
  • The App Center now supports Apps that require multiple containers to work by using docker-compose (Bug 43612).
  • In some cases the App Center removed installed listener modules (Bug 48104).
  • Never prompt in container commands during the app installation (Bug 47763).
  • Installation routines now ask for valid credentials before actually doing anything. Prior to this change, the user may have been prompted for credentials in the middle of the installation process. Invalid credentials at this point may have led to errors (Bug 47619).
  • Proxy settings in containers are updated before an app upgrade (Bug 47439).
  • When an app is opened in the App Center, the page now scrolls to the top and when the App detail page is closed, the previous scroll position is restored (Bug 39667).

§6.5.5. Univention Directory Manager UMC modules and command line interface

  • System accounts are not counted if the license allows unlimited users (Bug 48145).
  • Keep the choices for the modules in extended attributes updated (Bug 30387).
  • Added a new hook base class AttributeHook. This can be used to implement a mapping between LDAP and UDM for extended attributes (Bug 43129).
  • The username admin is now allowed (Bug 38092).
  • The UDM module settings/data was added. It can be used to store arbitrary data in LDAP (Bug 47944).
  • A new API has been added that aims to provide a much easier handles for UDM calls (Bug 47316).
  • The ordering of the default categories in the Portal unintentionally changed with a previous update. This has been reverted (Bug 47872).
  • Ensure update of syntax class mailinglist_name in running Python processes (Bug 48020).
  • Revert reloading syntax.py (Bug 48026).
  • Searching for some UDM properties led to a traceback (Bug 47910).
  • Some error messages are more explicit (Bug 47861).
  • Fix a traceback during portal assignment at computer objects when a settings/portal object is created (Bug 47818).
  • The search filter generated for boolean and multi-value properties of UDM objects was not correct (Bug 40672).
  • The visibility of a portal entry object can now be restricted to multiple groups instead of just one (Bug 46927).
  • For performance reasons, UDM stores the last used value of uidNumber and gidNumber in an LDAP object in the univentionLastUsedValue attribute. Usually these two values are monotonously increasing with automatic assignment. When manually specifying the uidNumber/gidNumber when creating an object, however, this value could jump back to a lower value and previously used and now free values could be reused if necessary. This behavior has now been disabled. univentionLastUsedValue is now monotonously increasing (Bug 41109).
  • User Templates now have access to the alphanum option (Bug 47580).
  • It is now possible to define custom categories for the portal (Bug 47243).
  • Allow to customize portal with an about page (Bug 43442).
  • Searching for some UDM properties led to a traceback (Bug 47910).

§6.5.6. Modules for system settings / setup wizard

  • The error messages for the join into an Active Directory domain have been improved (Bug 42430).
  • A regression introduced while fixing Bug 42022 could cause an appliance setup to fail due to missing software components (Bug 47767).
  • When setting up an UCS appliance to join into an existing UCS domain, the installation could fail due to a failure to reconfigure the network interfaces (Bug 47767).
  • Adapt Univention System Setup to work with Firefox 60 (Bug 47808).

§6.5.7. Domain join module

  • Only try to download the host certificate for 10 minutes when joining a new system. Otherwise, mark the join as failed (Bug 30005).
  • Fixed join failing when two MAC addresses are set on the computer object. Also, joining a host with multiple network interfaces now attaches them all to the computer object (Bug 47338).

§6.5.8. System diagnostic module

  • The ACL check for the Samba/AD SYSVOL files has been improved to show the name of missing files and directories (Bug 47583).
  • A new diagnostic plugin has been added that scans through LDAP and finds objects that lack a univentionObjectType although they should have one. The plugin also allows to migrate those objects. Having a univentionObjectType allows for other services to use a convenient LDAP filter (Bug 47844).
  • Improved logging of diagnostic module actions and the diagnostic checks are now executed in lexical order (Bug 47649).

§6.5.9. Policies

  • Log LDAP connections at log level PROCESS instead of INFO (Bug 48030).

§6.5.10. Filesystem quota module

  • Setting a user quota through a policy now works with journaled (usrjquota) quota as well (Bug 47764).

§6.5.11. Other modules

  • A widget for limited text input has been moved to the common library (Bug 48106).
  • The Univention Directory Manager module flavors are requiring a minimal set of allowed UMC commands now to be visible in the UMC (Bug 47880).
  • A regression in the users/self module regarding saving unset properties with default values has been addressed (Bug 48047).
  • The scrolling in the UCS Virtual Machine Manager module has been improved (Bug 36624).
  • The scrolling in the LDAP directory module has been improved (Bug 45598).
  • The search filter generated for boolean and multi-value properties of UDM objects was not correct (Bug 40672).
  • User Templates now have access to the alphanum option (Bug 47580).
  • It is now possible to define custom categories for the portal (Bug 47243).
  • The page now scrolls to the top when opening the detail page of an UDM object (Bug 39667).

§6.6. Univention base libraries

  • The function umc_init does not assume to find the LDAP group objects cn=Domain Admins and cn=Domain Users as direct children of the cn=groups container anymore. Instead it searches for them (or their localized equivalents, like Domänen-Admins) (Bug 38057).
  • Check output from slapschema during registration of new schemas for errors (Bug 45571).
  • The error messages for the join into an Active Directory domain have been improved (Bug 42430).
  • The UDM module settings/data was added. It can be used to store arbitrary data in LDAP (Bug 47944).
  • False warning message during App installation were removed (Bug 47931).
  • LDAP ACLs for the portal category module have been fixed (Bug 48091).
  • A spelling error in the English description for Univention Configuration Registry variable ldap/debug/level has been fixed (Bug 48102).
  • Fix automatic renewal of Diffie-Hellman parameters for forward secrecy (Bug 47974).
  • Adjust description of Univention Configuration Registry variable ldap/database/mdb/envflags (Bug 47869).
  • It is now possible to define custom categories for the portal (Bug 47243).
  • Allow to customize portal with static pages (Bug 43442).

§6.7. Software deployment

  • In case a Debian package update fails due to unmet dependencies univention-updater now logs a more useful error message (Bug 34444).

§6.8. System services

§6.8.1. PostgreSQL

  • The rule for the PostgreSQL superuser has been moved to the beginning of pg_hba.conf to always grant access to that internal user. This is required for automatic maintenance and similar tasks (Bug 31081).
  • The new Univention Configuration Registry variable postgres9/pg_hba/config/* allows for additional configuration options in the file pg_hba.conf (Bug 47276).

§6.8.2. Docker

  • ifconfig was missing in the UCS container. Also fixed parsing of the tool's output (Bug 46665).

§6.8.3. SAML

  • The Univention Directory Manager module flavors are requiring a minimal set of allowed UMC commands now to be visible in the UMC (Bug 47880).
  • Enable stunnel to run on systems without univention-saml installed, like member server and slave domain controller servers. The univention-saml package was updated to create the required directories (Bug 47250).

§6.8.4. Univention self service

  • The join script now always updates the local database password (Bug 45531).

§6.8.5. Mail services

  • Remove ClamAV from AMaViS configuration if clamav-daemon is disabled via Univention Configuration Registry variable clamav/daemon/autostart=no. Without this change Postfix is unable to process incoming mails due to a non-working AMaViS (Bug 39372).

§6.8.6. Dovecot

  • When creating users, an SSL error occurred when uploading the initial Sieve script if the Dovecot server used an external SSL certificate from Let's Encrypt, for example. The new Univention Configuration Registry variable mail/dovecot/sieve/client/server can now be used to specify an external FQDN for the Sieve script upload that matches the external SSL certificate (Bug 41018).

§6.8.7. Printing services

  • Fix a traceback when querying for printer users (Bug 44434).
  • The printer restrictions are reloaded after changes are made (Bug 43227).

§6.8.8. Nagios

  • The Nagios RAID check now uses the plugin mdstat (Bug 47319).

§6.8.9. RADIUS

  • From now on univention-radius adds a section realm in proxy.conf to allow RADIUS authentication with DOMAIN\USERNAME. The original proxy.conf is diverted to proxy.conf.debian and is included into the new proxy.conf (Bug 42535).
  • A user's description attribute is now no longer modified if the module ldap has been activated manually (Bug 48105).

§6.8.10. Proxy services

  • Squid is now compiled with support for OpenSSL again. This feature was lost during the update to UCS 4.3-0 because Squid 3.5 requires an additional compile time option for this (Bug 47809).

§6.8.11. SSL

  • The cron job to revoke expired certificates now works properly again (Bug 47896).
  • SSL host certificates are now also valid for DNS alias records (Bug 44469).
  • The command univention-certificate renew does not revoke the old certificates anymore, so that they are still valid until they expire. Additionally, certificates can now get addressed by their serial numbers using the option -id (Bug 41013).

§6.9. Virtualization

§6.9.1. UCS Virtual Machine Manager (UVMM)

  • Show a warning if the entered VNC password for a virtual machine exceeds a certain length (Bug 48106).
  • Report IO errors in UMC frontend (Bug 22695).
  • Drop corrupt cache files on errors (Bug 35761).
  • Fix assignment of target device name for newly added disks (Bug 47956).
  • Migration of virtual machines between incompatible CPUs can be prevented by setting the new Univention Configuration Registry variable uvmm/vm/cpu/host-model to either missing or always: This modifies the XML description to include a description for the CPU of the host system for running virtual machines. If a CPU description is present, UVMM will check the target host for compatibility. The migration is aborted if the target host's CPU is not compatible. Virtual machines must be restarted to activate pending changes. UVMM monitors running virtual machines for reboot events and restarts them automatically (Bug 21386).

§6.10. Services for Windows

§6.10.1. Samba

  • Always set map acl inherit = yes for samba shares if NT ACLs and inherit ACLs are activated (Bug 47850).
  • Ignore netlogon_creds_cli.tdb in univention-samba4-backup (Bug 46468).
  • Changing the primary group of a user triggered an inconsistency in the DN SID component of the member attribute. In special situations samba-tool dbcheck was unable to fix this automatically (Bug 48054).
  • Continue samba-tool dbcheck --fix even if a modification failed (Bug 48040).
  • When joining a new Samba/AD DC, Samba replicates all LDAP partitions independently. Depending on timing the replication of the linked attribute serverReference could fail, if CN=Configuration gets replicated before the main domain partition. As a result DRS replication could fail (Bug 47441).

§6.10.2. Univention S4 Connector

  • When performing an AD-Takeover out of an ad/member setup, the S4-Connector reported tracebacks due to missing NT password hashes in OpenLDAP (Bug 35540).
  • Fix sync_to_ucs reject for DNS Start of Authority (SOA) records with trailing dot missing in the Name Server (NS) resource record (Bug 44104).
  • An indentation bug in the mapping file of the S4-Connector has been fixed which triggered an error in cases where Univention Configuration Registry variable connector/s4/mapping/dns/ignorelist was unset or empty (Bug 44711).
  • The group membership sync now correctly identifies ucs_module_others if defined in the mapping (Bug 47779).
  • Renaming a container (only difference in upper and lower case) has been fixed (Bug 47374).
  • When password change on next login had been activated for a user the S4-Connector removed shadowMax and krb5PasswordEnd and reset shadowLastChange to 0 when synchronizing changes back from Samba/AD to UDM/OpenLDAP. In an UCS@school specific UMC module this caused a display issue, where the next required password change was shown as never (Bug 47508, Bug 47595).
  • The S4-Connector no longer updates the obsolete attribute sambaPwdMustChange (Bug 45282).

§6.10.3. Univention Active Directory Connection

  • The Connector now updates the AD attribute userPrincipalName if the UCS username is changed. This is enabled only for new installations. For old systems unset Univention Configuration Registry variable connector/ad/mapping/sync/userPrincipalName and restart the AD-Connector to sync username to userPrincipalName on subsequent object modifications (Bug 48153).
  • univention-adsearch now accepts space separated attribute list as parameter (Bug 43189).
  • Non-printable attributes in univention-adsearch are printed base64 encoded (Bug 48082).
  • The special cn=Subschema object caused AD-Connector rejects (Bug 47396).
  • The synchronization of the attribute proxyAddress may fail if is empty (Bug 46751).
  • Fix AD to UCS password hash synchronization in cases where a custom Domain Admin account is configured for the AD connection (Bug 47069).
  • The error messages for the join into an Active Directory domain have been improved (Bug 42430).
  • Fix Kerberos authentication error during AD-Connector restart in AD/member mode in case of changed system time (Bug 48227).
  • The synchronization of password hashes from AD to UCS has been fixed on systems that have Univention Configuration Registry variable connector/ldap/server set to a non-master server with read-only OpenLDAP (Bug 44024).
  • The package univention-ad-connector-exchange did reset specific Univention Configuration Registry variable values to their default during the update. This has been adjusted to keep customer adjusted values untouched (Bug 47856).
  • The tool univention-adsearch now also uses the file containing the full certificate chain instead of only the exported AD certificate alone (Bug 47858).
  • Support SASL/GSSAPI in AD Connection setup scripts (to support integrity checking during binds) (Bug 47901).
  • A traceback during the add of users in AD with telephone attributes has been fixed (Bug 47209).

§6.11. Other changes

  • Adapt to changes in univention-directory-manager-modules (Bug 47861).
  • The machine account password is changed by default every 21 days. That check is by default performed nightly a 01:00 by a cron job. That point of time can now be configured through the new Univention Configuration Registry variable server/password/cron (Bug 47781).