Changelog for Univention Corporate Server (UCS) 5.0-6#

General#

  • The following updated packages from Debian 10.13 are included:

    activemq amanda asmtools audiofile axis batik cargo-mozilla ceph cryptojs distro-info distro-info-data e2guardian exempi freeimage freerdp2 frr gerbv gimp gimp-dds gnome-boxes gsl h2o horizon inetutils jetty9 jtreg6 libapache-mod-jk libclamunrar libcue libvpx libyang lldpd lwip minizip mutt netty node-babel node-browserify-sign node-cookiejar node-json5 opendkim org-mode orthanc phppgadmin pmix postgresql-multicorn prometheus-alertmanager python-requestbuilder qemu redis reportbug request-tracker4 roundcube ruby-loofah ruby-rails-html-sanitizer ruby-rmagick ruby-sanitize rust-cbindgen rustc-mozilla strongswan tang testng7 thunderbird tomcat9 trapperkeeper-webserver-jetty9-clojure vinagre vlc zbar zookeeper

  • The following packages have been moved to the maintained repository of UCS:

    py-lmdb (Bug #53387)

  • Execute the pre-installation script for server role Primary Directory Node with bash. This is needed to create the SSL/TLS certificate (Bug #56046).

Univention Configuration Registry#

Changes to templates and modules#

  • The configuration file /etc/selinux/config has been added to disable SELinux. SELinux is not supported by UCS (Bug #56005).

OpenLDAP#

Listener/Notifier domain replication#

  • Some new attributes that will be provided by OpenLDAPs ppolicy from version 2.5 on, were removed from the schema replication exclusion list, to allow interoperability with the new OpenLDAP version (Bug #56729).

  • The script univention-directory-replication created a temporary password file with a newline in it, which therefore contained an invalid password. This resulted in slapd not being able to import a file failed.ldif on startup. This fixes a regression from UCS 5.0 erratum 870 (Bug #56801).

Univention Management Console#

Univention Management Console web interface#

  • The request header If-Match can now be given in DELETE requests to make them conditional (Bug #56731).

  • Missing properties when creating or modifying objects are now correctly marked in the error response (Bug #56734).

  • The unsupported HTML developer view of the UDM REST API has been disabled and can be enabled via the Univention Configuration Registry Variable directory/manager/rest/html-view- enabled (Bug #56714).

  • Duplicate settings for the Keycloak app have been removed from the theme styles (Bug #56548).

  • The error handling for progress bars has been improved so that Apache restarts during app installations don’t cause failures anymore (Bug #56562).

Univention Portal#

  • The deletion of a user’s profile picture via Self Service has been repaired (Bug #56349).

  • The labels of the Self Service forms were always displayed in English when they were accessed directly via URL without navigating through the portal. They are now translated correctly (Bug #56660).

  • Update file portals.json atomically to prevent inconsistent reading (Bug #53860).

Univention Management Console server#

  • The detection of active requests has been corrected so that module processes cannot be exited anymore if there are still open requests. This was broken since Bug #56198 UCS 5.0 erratum 721 (Bug #56575).

  • The configured maximum request body size is now respected (Bug #56510).

  • The maximum number of parallel HTTP connections from the UMC-Server to UMC module processes has been raised from 10 to unlimited (Bug #56828).

  • User preferences (such as favorite Univention Management Console modules) could not be set via old UMC clients from UCS systems before UCS 5.0-3. The functionality has been restored (Bug #56753).

  • Explicit defaults for cookie settings were added to /var/www/univention/meta.json so they are available for all components that needs them (Bug #56703).

Univention App Center#

  • A broken internal JSON file will no longer crash the univention-appcenter-listener-converter. If a broken JSON file is found, it will be skipped and logged in the log file /var/log/univention/listener_modules/<app id>.log (Bug #56421).

Univention Directory Manager and command line interface#

  • The If-Match request header can now be given in DELETE requests to the UDM REST API to make them conditional (Bug #56731).

  • Missing properties when creating or modifying objects via the UDM REST API are now correctly marked in the error response (Bug #56734).

  • The unused UDM properties from Nagios server have been marked as optional to ease the upgrade to UCS 5.2 (Bug #56820).

  • The Python 3.11 compatibility for timezone handling has been repaired (Bug #56514).

  • The case sensitivity of the attribute memberUid is now respected when removing members from a group (Bug #54183).

  • The command univention-admin has been removed. It was deprecated since UCS 3.0 (Bug #53802).

Modules for system settings / setup wizard#

  • The process to renew all SSL/TLS certificates has been improved. For each host the symbolic link pointing to the fully-qualified host name is now created as a relative link. Error cases are better detected and handled. All changed SSL/TLS profile settings are now propagated into a new CA certificate. The policy enforced by OpenSSL on the certificate settings is now also checked and enforced in the UMC module Certificate settings (Bug #34106).

  • The connection check to the package repository now explicitly uses the proxy settings (Bug #48126).

Domain join module#

  • The join-scripts are now executed with umask 022 instead of the restrictive umask 077 from the UMC Server (Bug #53431).

System diagnostic module#

  • Include new diagnostic module to check if PostgreSQL is migrated to version 11 (Bug #56773).

  • The text Success is no longer displayed when a check failed after all checks have previously passed (Bug #56624).

  • Include new diagnostic module to check the correct setting of Univention Configuration Registry Variable ldap/master (Bug #48548).

File system quota module#

  • Querying users for a partition runs into a timeout after 10 minutes when there are many users (Bug #56575).

Univention base libraries#

  • The registration of LDAP schema files failed if the schema file is the first file in the directory and there is already a local schema file with the same name which was not registered via LDAP (Bug #56857).

  • The unused LDAP attributes from Nagios server have been marked as optional to ease the upgrade to UCS 5.2 (Bug #56820).

  • UCS 5.0 erratum 785 introduced a new mechanism in ucs_registerLDAPExtension to re- trigger the activation of an LDAP ACL or schema extension by doing a trivial (i.e. no-op) LDAP modification. This failed on the Primary node due to missing credentials. ucs_registerLDAPExtension has been fixed to use the LDAP admin connection in this case (Bug #56698).

  • The program univention-backup2master has been improved and handles more corner-cases correctly. Entries of other hosts are now skipped, whose name only contains the name of the old Primary as a sub-string. Handling of shares, mail, host, and service records has been reworked (Bug #46062).

Software deployment#

  • The software update module will not show UCS 5.1-0 as available version for upgrade because it is an intermediate version between UCS 5.0 and UCS 5.2 to which an upgrade will not be possible (Bug #56517).

  • The internal tool ucslint is now independent from the current working directory. It has been fully converted to Python 3.7 code, which changes the API for its plugins. Performance has also been improved and several small bugs have been fixed. This found several new issues in other packages, which previously had not been detected. Some of them have also been fixed (Bug #55668).

System services#

SAML#

  • univention-keycloak init is now able to be executed again in case of a failure during first initialization. The option --force has been added to force the rerun of the initialization (Bug #56791).

  • A script which checks the migration status from SimpleSAMLPHP / OpenID Connector Provider to Keycloak has been added to the package univention-keycloak (Bug #56747).

  • The commands messages and login-links have been added to manage Keycloak message bundles and login links for the login page (Bug #56478).

  • The Python 2.7 compatibility for the Univention Configuration Registry template file /etc/simplesamlphp/00authsources.php has been restored (Bug #56588) and was ported back to UCS 5.0-4 (Bug #56647).

  • A workaround has been added which prevents a potential LDAP schema registration failure (Bug #56857).

  • UCS 5.0 erratum 881 broke mixed environments with UCS 4.4. Therefore the UDM modules are now only registered for UCS 5 based systems (Bug #56864).

  • The LDAP schema and UDM modules are now registered in the LDAP and therefore replicated to all servers in the domain to ease the upgrade to UCS 5.2 (Bug #56824).

Mail services#

  • The detection whether a user is a Fetchmail user (by checking if they have an attribute mailPrimaryAddress) during modifications of users has been repaired. Therefore when the mailPrimaryAddress is changed or removed the correct changes are synchronized to Fetchmail (Bug #56482).

  • Deleting Fetchmail configurations of a user now correctly removes entries from the file fetchmailrc in case they are the last ones (Bug #56426).

  • Narrowed down the conditions under which the Univention Directory Listener module gets called (Bug #56586).

SSL#

  • The missing dependency on the package ca-certificate has been added as the common root Certificate Authority certificates are required to access public services like the Univention download server (Bug #51203).

  • Certificate identifiers are now compared as strings. Previously certain identifiers like 2e2 had been handles as floating-point numbers in scientific notations by awk (Bug #54834).

DHCP server#

  • The network installer has been converted from a SysV init script into a systemd unit. URLs configured for Univention Configuration Registry Variable repository/online/server are now handled correctly.

PAM / Local group cache#

  • Future compatibility with sudo version 1.9.4 has been added, where additional environment variables need to be passed explicitly to sub-processes (Bug #56579).

Services for Windows#

Samba#

  • univention-samba4-backup now uses the samba-tool backup command to create a backup of the Samba database and the directory syslog (Bug #56434).

  • The Univention Configuration Registry Variables samba/database/backend/store and samba/database/backend/store/size have been added to configure the Samba database backend (tdb or mdb) before the initial setup, join or re-join (Bug #56401).

  • The Samba package now recommends the package python3-lmdb (Bug #53387).

  • Under certain conditions, installation of the package univention-samba4 aborted because of a missing package dependency on a specific version of samba-dsdb-modules, when an older version of that package was already installed. This is addressed by making the package univention-samba4 depend on the meta-package samba-ad-dc instead, and letting that manage a versioned dependency on samba-dsdb-modules. This simplifies the package dependencies (Bug #56794).

  • The package samba-ad-dc now depends on a specific version of samba-dsdb-modules to upgrade the initially installed version to the one required during installation. This addresses issues when an ISO was used for installation that did not already include the latest Samba provided by errata updates (Bug #56794).

  • The package samba-ad-dc now depends on a specific version of samba-ad-provision, instead of only recommending it. This addresses issues when installing directly from the UCS 5.0-6 ISO image (Bug #56870).

  • The modified dependency of univention-samba4 on samba-ad-dc introduced by UCS 5.0 erratum 890 caused libnss-winbind to be installed. This package modified file:/etc/nsswitch.conf adding winbind to it. This has been reverted (Bug #56885).

  • Symbolic links in the directory sysvol will no longer break the Samba backup tool (Bug #56866).

Univention S4 Connector#

  • Starting with UCS 5.0 the Univention S4 connector converted POSIX-only groups to Samba groups. This was a regression compared to the behavior in UCS 4.4. Now the mapping offers a new key auto_enable_udm_option that is disabled by default and is only activated for the UDM property userCertificate, allowing changes of UDM object options just in that special case (Bug #56772).

  • Future compatibility for python3-ldap >= 4 has been added (Bug #56603).

  • Future compatibility for python3-samba has been added (Bug #56537).

Univention Active Directory Connection#

  • During synchronization from an MS AD forest child domain, the Univention AD connector may receive DNs that refer to objects outside the scope of the child domain. In that case it receives an LDAP referral which caused a python traceback. The Univention AD connector now skips referrals to objects and logs an informative message instead (Bug #56792).

  • The Univention AD connector failed to handle forest child domains (Bug #53944).

  • Future compatibility for python3-ldap >= 4 has been added (Bug #56603).