In addition to the traditional installation, there is also the possibility of providing UCS via an appliance image. These appliance images can be used both for simple commissioning in a virtualization solution such as VMware and for providing a cloud instance.

Appliances can be created with minimal effort. This is described in Chapter 2.

Whilst some of the settings can be preconfigured globally in the image, it is still necessary for the end user to make final adjustments to the configuration, e.g., to set the computer name or the domain used. For this reason, a basic system is installed for the appliance image and a component set up, which then allows the end user to finalise the configuration. Alternatively, the configuration can also be performed automatically without user interaction. This is described in Section 2.3.

The interactive configuration can be performed in two ways:

A graphic interface starts on the system, in which the web browser Firefox is started in full-screen mode and automatically accesses the configuration URL. This option is particularly suitable for images in virtualization solutions.
The configuration can also be performed directly via an external web browser. In this case, the system's IP address must be known to the user (e.g., if it has been notified to him in advance in the scope of the provision of a cloud image).

In the scope of the initial configuration, the user can change the following settings in the default setting:

Selection of the language, time zone and keyboard layout
Configuration of the network settings
Setup of a new UCS domain or joining a UCS or Microsoft Active Directory domain
Software selection of UCS key components. The user can install software from other vendors at a later point in time via the Univention App Center.

§Chapter 2. Creating a UCS appliance/cloud image

§2.1. Introduction

This article describes how to set up an appliance based on UCS 4.0. This type of appliance can also be used to provide preconfigured instances as a cloud service provider. The creation of images for typical virtualization solutions is another possible application scenario, see Section 2.2.3.

§2.2. Performing the basic installation

The basic installation is performed using the standard UCS installer. Further information on the individual options can be found in the UCS manual. The installation should be performed in a virtualization solution. In this example, the installation is performed in UVMM. A qcow2 image should be selected for the hard drive for the virtual machine. Qcow2 images can be converted to different virtualization formats such as VirtualBox or VMware using a tool provided by Univention, see Section 2.2.3.

The following settings are configured for the basic image:

The installation language can be selected as required. The locale of the system is set based on the selected language. If you want to be able to use the appliance in more than one language, you can add another locale at a later point in time.
A preselection is made for the time zone which is then adapted subsequently by the users of the appliance.
The keyboard layout is only relevant for local logins; it is not important for the web-based configuration.
A configuration via DHCP is the most practical presetting for appliance images. The Univention Installer attempts to perform a DHCP request in the scope of the network configuration. The network configuration is only performed via DHCP if this is successful, i.e., an IP address must be assigned to the appliance for the duration of the setup. This can be done with an IP managed client object in the Univention Management Console.
In the next step, the initial password is set for the root user. This root password is changed by the end user during the commissioning of the appliance image.
The partitioning can be performed as required, e.g., by using an LVM. For an image that will be used in a cloud setup, a single root partition should be used. This allows growing the root partition based on the selected instance disk size.

Once the basic installation is complete, a dialogue is shown in which you can select whether to create a new UCS domain or join an existing domain. To create the appliance, Control+Q must be pressed at this point to interrupt the process. The installation continues for a short period of time, during which the Starting Univention System Setup message appears and the systems then restarts.

The installation of the basic image is now complete. Following a reboot, the user of the appliance is shown the dialogue for adjusting the configuration, see Chapter 1.

In most cases, the appliance needs to be preconfigured with a certain selection of software. The installation is usually performed via the Univention App Center, which, however, is not yet available at this point in time. The installation is thus performed via the command line. UCS standard components can be installed using the corresponding package names, e.g.

univention-install univention-printserver

Packages from the Univention App Center are installed with the command univention-add-app once a valid license is available. The ID of an application can be retrieved with the command univention-add-app --list:

univention-add-app -l APPID

The system now needs to be shut down cleanly without filesystems still being mounted.

The qcow2 image (i.e., the hard drive of the virtual machine) is now copied. If the default storage pool of UVMM was used, the image is stored in the directory /var/lib/libvirt/images/.

Additional steps are required if the image is to be used in Amazon EC2 (see Section 2.2.1), OpenStack (see Section 2.2.2) or as a VMware / VirtualBox appliance (see Section 2.2.3).

§2.2.1. Providing an image for Amazon EC2

The following adjustments need to be made for an image that is to be used in Amazon EC2.

Amazon EC2 uses a PyGrub version which can only read the data format from Grub 1 (menu.lst), whilst UCS uses Grub 2 as the bootloader. The following Univention Configuration Registry variables can be used to generate the Grub configuration in this format additionally. The bootloader configuration is also adapted:

append="$(ucr get grub/append)"
ucr set grub/append="$(echo "$append" |
 sed -e 's|/dev/sda|/dev/xvda|g;s|splash|nosplash|')"
ucr set grub/root=/dev/xvda1
ucr set grub/grub1root="(hd0)"
update-initramfs -uk all
update-grub
univention-grub-generate-menu-lst

The initial login to the EC2 instance is performed via a SSH host key. To prevent SSH logins from occurring with the default root password of the standard image during commissioning of the instance, the initial root password is removed. The following Univention Configuration Registry variable configures this start mode:

usermod -p \* root
ucr set server/amazon=true

The name server should be set; in this example to OpenDNS. Additionally, the timeout when waiting for a DHCP request answer is lowered.

ucr set nameserver1=208.67.222.222 dns/forwarder1=208.67.222.222
ucr unset nameserver2 nameserver3
ucr unset dns/forwarder2 dns/forwarder3
ucr set interfaces/eth0/type=dhcp dhclient/options/timeout=12

§2.2.2. Providing an image for OpenStack

The provisioning for OpenStack images occurs via Cloud-Init (see Section 2.3.2). Cloud-Init is a standardised solution for configuration of an image. Cloud-Init checks a range of data sources for an existing configuration. The univention-cloud-init package must be installed to prepare an image for provisioning via Cloud-Init:

univention-install univention-cloud-init

The local Firefox session should not be started when running as an OpenStack instance.

ucr set system/setup/boot/start=false

The initial login to the OpenStack instance is performed via a SSH host key. To prevent SSH logins from occurring with the default root password of the standard image during commissioning of the instance, the initial root password is removed.

usermod -p \* root

§2.2.3. Providing an image for VMware/VirtualBox

Virtualization images for VirtualBox, VMware Player and VMware ESX can also be created on the basis of the qcow2 images above. To this end, Univention offers a tool, which can be installed via the generate-appliance package (the integration in UCS 4.0 can be followed via Bug 37137).

The generate_appliance tool must be started and the qcow2 image selected with the parameter -s:

generate_appliance -s appliance.qcow2

The virtual machine is assigned one CPU and a gigabyte of RAM as standard. If the appliance has a higher storage or CPU power requirement, the parameter -m can be used to specify a different quantity of RAM in megabytes and -c can be used to assign a different number of CPUs. The parameters --vendor and --product can be used to specify a vendor and product name.

In the default setting, three different virtualization images are generated from the qcow2 image. The generation for a type can be suppressed using the respectively given option:

Zipped VMware compatible images (e.g. for VMware Player), can be suppressed with --no-vmware
VirtualBox OVA image, can be suppressed with --no-ova-virtualbox
VMware ESX OVA image, can be suppressed with --no-ova-esxi

§2.3. Automatic configuration of an appliance

Instead of an interactive configuration of the appliance by the user, it can also be performed automatically. The automatic configuration can either be performed via cloud-init (a general tool for the provision of cloud images) or a Univention appliance mode profile file.

§2.3.1. Automatic configuration with a UCS appliance mode profile file

Automatic configuration with the UCS appliance mode requires creating a profile file /var/cache/univention-system-setup/profile. Example configuration:

hostname="ucs"
domainname="testdom.local"
windows/domain="TESTDOM"
ldap/base="dc=testdom,dc=local"
root_password="univention"

locale/default="de_DE.UTF-8:UTF-8"
components="univention-s4-connector:univention-samba4 univention-nagios-server"
packages_install="univention-s4-connector univention-samba4 univention-nagios-server"
packages_remove=""

server/role="domaincontroller_master"

interfaces/eth0/type=""
interfaces/eth0/address="10.201.101.2"
interfaces/eth0/netmask="255.0.0.0"
interfaces/eth0/network="10.0.0.0"
interfaces/eth0/broadcast="10.255.255.255"
dns/forwarder1="10.201.74.2"
gateway="10.201.0.1"

If interfaces/eth0/type is set to dynamic, DHCP is used for the network configuration.

Then the /usr/lib/univention-system-setup/scripts/setup-join.sh tool needs to be run once. Then Apache and the UMC server need to be restarted:

invoke-rc.d apache2 restart
invoke-rc.d univention-management-console-server restart

§2.3.2. Automatic configuration of an appliance with Cloud-Init

Cloud-Init works on a configuration file in the cloud configuration format. The configuration file is provided by the respective cloud service; the type of provision differs from cloud solution to cloud solution. It is currently only possible to provide a master domain controller.

The configuration file may be adapted for different scenarios. To setup a domain, the ucs_setup section is required. Note that the supplied ldap_base is used in other configuration sections as well.

The following includes an example file with which a master domain controller can be provided. In addition, several files are generated on the system: the UCS license to be installed and a file with the apps to be installed from the Univention App Center. The license in this example is the default core edition license. More information about requesting a proper license can be found in Section 2.3.3.

Two example hook scripts are generated which are called after setup is finished: One calls wget for a given URL, which could be used to signal an external service that the provisioning of the instance is done. The other is an example udm call to register an OpenStack connection in UVMM.

#cloud-config
#
ucs_setup:
  hostname: myucsmaster
  domainname: ucs.local
  windowsdomain: UCS
  ldap_base: dc=ucs,dc=local
  rootpassword: univention
  defaultlocale: de_DE.UTF-8:UTF-8
  components:
  packages_install: univention-virtual-machine-manager-daemon
  packages_remove:
write_files:
-   content: |
      dn: cn=admin,cn=license,cn=univention,dc=ucs,dc=local
      objectClass: top
      objectClass: univentionLicense
      objectClass: univentionObject
      univentionObjectType: settings/license
      univentionLicenseEndDate: unlimited
      univentionLicenseModule: admin
      cn: admin
      univentionLicenseBaseDN: UCS Core Edition
      univentionLicenseUsers: unlimited
      univentionLicenseServers: unlimited
      univentionLicenseManagedClients: unlimited
      univentionLicenseCorporateClients: unlimited
      univentionLicenseVirtualDesktopUsers: 0
      univentionLicenseVirtualDesktopClients: 0
      univentionLicenseSupport: 0
      univentionLicensePremiumSupport: 0
      univentionLicenseVersion: 2
      univentionLicenseType: UCS
      univentionLicenseSignature: ZjofoUmITUqpyF5q+AfE1i6EwsKXGWYnkh3JLJH3/bXqvD26nG
       aLa+cpcr6g9Stkx2Lslh1feGCpsdvowkA3T+SFtPHSX0Fds78QgyatoiFlA6mbbtMf3ABbMfW9Glt
       IZBbxxDFD+hMO/7yOHwaFZM3xb1I2ToJ1D2+xvOxrZe2SCZd4KJIXpupnmJnAC/D4Y9iqHPytVPU3
       QlI6zXnGU5q47RN/tdXLTpV7mHoiXRWh282TNOlnEiiQxwiQ4u2ghWE1x/EWY/CXvZm0PQcsFqGyB
       v72WdEUOex1Yuf3BgZ7QfLOQ2XIv6KPKCyYqZqlSNp8Xk+IpKjDqL+aq0oyeg==
    owner: root:root
    path: /var/cache/univention-system-setup/license
    permissions: '0400'
-   content: |
      simplesamlphp
      adconnector
    owner: root:root
    path: /var/cache/univention-system-setup/installapps
    permissions: '0400'
-   content: |
      #!/bin/sh
      wget http://myURL/page?myparam=myValue
    owner: root:root
    path: /usr/lib/univention-system-setup/appliance-hooks.d/90_wget_url
    permissions: '0755'
-   content: |
      #!/bin/sh
      udm uvmm/cloudconnection create --ignore_exists \
      --position="cn=CloudConnection,cn=Virtual Machine Manager,dc=ucs,dc=local" \
      --set name="OpenStack" \
      --set type="cn=OpenStack,cn=CloudType,cn=Virtual Machine Manager,dc=ucs,dc=local" \
      --set includeUCSimages=0 \
      --append parameter="username demouser" \
      --append parameter="password password" \
      --append parameter="cloudtype OpenStack" \
      --append parameter="auth_url http://192.168.0.1:5000" \
      --append parameter="auth_version 2.0_password" \
      --append parameter="service_type compute" \
      --append parameter="service_name nova" \
      --append parameter="tenant demotenant" \
      --append parameter="service_region regionOne"
      invoke-rc.d univention-virtual-machine-manager-daemon restart
    owner: root:root
    path: /usr/lib/univention-system-setup/appliance-hooks.d/80_add_uvmm_connection
    permissions: '0755'

The file with the apps to be installed contains a list of IDs of applications from the Univention App Center, see Section 2.2. The list in the example above installs the Univention AD Connector and the SAML integration on the provided master domain controller

§2.3.3. License management in cloud instances

In the default installation, a UCS installation has a core edition license. An updated license from Univention is required in order to use the App Center. For standard installations it is sent to the user by e-mail and then set up in the Univention Management Console.

Cloud service providers have the possibility of retrieving UCS licenses via an API, i.e., if a new instance is to be created for a customer, the license can be retrieved via the API and then installed in the provided instance directly.

Access to the license server requires a user name and a password. These can be requested from Univention at <sales@univention.de>. In this document, https://license.univention.de/shop/example/ is used as an example URL for the license server.

§2.3.3.1. API for retrieving UCS licenses

The licenses are retrieved via HTTPS from the Univention license server license.univention.de. The retrieval can be performed completely with wget.

Firstly, a session with the license server must be opened, in this case with the user name univention and the password secret as an example. It is also possible to request more than one license in one session.

wget --keep-session-cookies --save-cookies cookie.db --load-cookies \
 cookie.db --post-data='username=univention&password=secret' \
 https://license.univention.de/shop/example/

A license can also be ordered with a POST request via wget. Please note that special characters such as blank spaces must be escaped in URL-encoded syntax, see http://en.wikipedia.org/wiki/Percent-encoding for details.

wget --keep-session-cookies --save-cookies cookie.db --load-cookies cookie.db \
--post-data='kundeEmail=customer@example&'\
'kundeUnternehmen=New%20Customern&'\
'EndDate=27.11.2015&'\
'BaseDN=dc%3Ddrei%2Cdc%3Dzwei%2Cdc%3Dtest&'\
'Servers=0&'\
'Support=0&'\
'PremiumSupport=0&'\
'Users=100&'\
'ManagedClients=0&'\
'CorporateClients=0&'\
'VirtualDesktopUsers=0&'\
'VirtualDesktopClients=0&'\
'Type=UCS' \
https://license.univention.de/shop/example/order

If the order is successful, the return code 202 is returned. The HTML data includes the tag orderid, which identifies the order number of a successful order:

...
<span id="orderid">21</span>
...

If the order fails, a return code 4xx is returned and the details tag includes additional information, e.g.:

...
<span id="details">Not a valid date: u'27.11.201'</span>
...

Should it not be possible to process an order due to a server error, 5xx is output as the return code. The order can then be repeated at a later point in time.

Following ordering of a license, it takes a few seconds before the license is generated. It can then be retrieved in LDIF format using the order number. If the request above returns e.g. the order number 465, the file name is thus 465.ldif. The request specified below waits for the availability of the license for up to sixty seconds:

wget --keep-session-cookies --save-cookies cookie.db --load-cookies cookie.db \
https://license.univention.de/shop/example/orders/465.ldif

§Chapter 3. Profile-based installation

In addition to the interactive installation described in the [ucs-manual], a profile-based installation of UCS is also possible. With this method, the settings for the Debian Installer and Univention System Setup are specified in a pre-seed file. If all the required settings are included in the installation profile, it is possible to perform the installation fully unattended. Otherwise the installer will ask interactively for missing values.

§3.1. Structure of profile files

An installation profile is a text file which can be edited with any editor. The file must use the UTF-8 character encoding. Empty lines and lines starting with a hash character (#) are ignored. All other lines should follow the four column layout required by debconf, which is fully described in [d-i]:

# Comment
<owner>	<question name>	<question type>	<value>

The owner of most questions will be d-i, which is the Debian Installer. The question type depends on the questions and can be boolean, string or select. Any questions not answered by the pre-seed file is asked interactively and will prevent an unattended installation.

§3.2. Example installation profile

A template file is provided as /usr/share/doc/univention-net-installer/examples/TEMPLATE. It contains the minimum required settings to perform a fully automatic installation of a member server with no additional software. It will use the German keyboard layout and language settings. It will re-partition the hard-disk without asking any questions and will use LVM to manage the disk space. No additional software will be installed.

#
# This file overwrites /proc/cmdline overwrites preseed.cfg in the InitRamFs!
#

#
# The following options are set through the PXE configuration ❶
#
# Delay asking for locale and keyboard layout after pre-seeding via network
#d-i auto-install/enable boolean true
# Only ask for critical questions
#d-i debconf/priority select critical
# Disable graphical installer
#d-i debian-installer/framebuffer boolean false

#
# Select German as default locale and for keyboard layout ❷
#
d-i debian-installer/locale string de_DE.UTF-8
d-i keyboard-configuration/xkb-keymap select de(nodeadkeys)
#d-i keyboard-configuration/modelcode string pc105
d-i ucr/xorg/keyboard/options/XkbModel string pc105
#d-i keyboard-configuration/layoutcode string de
d-i ucr/xorg/keyboard/options/XkbLayout string de
#d-i keyboard-configuration/variantcode string nodeadkeys
d-i ucr/xorg/keyboard/options/XkbVariant string nodeadkeys
#d-i keyboard-configuration/optionscode string
d-i ucr/xorg/keyboard/options/XkbOptions string
#d-i debian-installer/keymap select de-latin1-nodeadkeys

#
# Configure local repository server
#
d-i debian-installer/allow_unauthenticated boolean true
d-i mirror/country string manual
d-i mirror/protocol select http
d-i mirror/http/proxy string
# The host name of the repository server is filled through the PXE configuration generated by UDM
#d-i mirror/http/hostname string ... ❸
d-i mirror/http/directory string /univention-repository/4.0/maintained/4.0-2 ❹
d-i mirror/codename string ucs401
d-i mirror/suite string ucs401
d-i mirror/udeb/suite string ucs401

#
# Disable password for user 'root'
#
d-i passwd/root-login boolean true
# Alternative: printf "secret" | mkpasswd -s -m sha-512
d-i passwd/root-password-crypted string * ❺

#
# Partition hard disk: Use "lvm" and one big "/" partition ❻
#
# Choices: lvm crypto regular
d-i partman-auto/method string lvm
# Choices: atomic home multi
d-i partman-auto/choose_recipe string atomic
d-i partman-lvm/device_remove_lvm boolean true
d-i partman-md/device_remove_md boolean true
d-i partman-lvm/confirm boolean true
d-i partman-lvm/confirm_nooverwrite boolean true
d-i partman-partitioning/confirm_write_new_label boolean true
d-i partman/choose_partition select finish
d-i partman/confirm boolean true
d-i partman/confirm_nooverwrite boolean true

#
# Disable starting "Univention System Setup Boot" ❼
#
d-i ucr/system/setup/boot/start string false

#
# Univention System Setup profile
#
#univention-system-setup-boot uss/root_password string
univention-system-setup-boot uss/components string
univention-system-setup-boot uss/packages_install string
univention-system-setup-boot uss/packages_remove string
# Choices: domaincontroller_master domaincontroller_backup domaincontroller_slave memberserver base
univention-system-setup-boot uss/server/role string memberserver
#univention-system-setup-boot uss/ldap/base string dc=example,dc=com

§❶	These settings are configured through the PXE command line parameters. They are listed here for reference only and cannot be changed through this file.
§❷	If the locale settings are not consistent, the installer will ask interactively for corrections. The keyboard related settings must be configured through Univention Configuration Registry - the questions starting with `keyboard-configuration/xkb-…` will not work!
§❸	The location of the local repository is filled in through the PXE configuration. By default the value of the Univention Configuration Registry variable `repository/online/server` is used. It can be over-written by specifying the value here in the profile file.
§❹	These directory and release names must be kept in sync to select the right UCS release. This example consistently uses the UCS-4.0-2
§❺	By default no password is set, which will prevent logging in. It should be replaced by an encrypted password, which can be used by running a command like `printf "secret" \| mkpasswd -s -m sha-512`
§❻	By default all existing partitions will be wiped without asking any question! They will be replaced by a single file system for `/` using LVM. See [d-i] for more advanced partitioning schemas.
§❼	This sections contains the UCS specific settings, which are normally configured through Univention System Setup. For an unattended installation the graphical installer is disabled. All other values starting with `uss/` are copied to the installation profile. The variables are described in Section 3.3.

§3.3. Overview of profile variables

§3.3.1. Profile variables - System properties

The following profile variables can be used to specify basic properties of the computer such as the computer name, its role within the UCS domain and the name of the domain the computer should join.

Table 3.1. Profile variables - System properties

Name	Function
`server/role`	The system role. You may choose from `domaincontroller_master`, `domaincontroller_backup`, `domaincontroller_slave`, `memberserver` and `base`. The properties of the system roles are described in the domain services chapter of the [ucs-manual].
`hostname`	The computer name. The name must only contain the letters `a` to `z` in lowercase, the figures `0` to `9` and hyphens. Although underscore are allowed as well, they should not be used as they are not supported everywhere. The name must begin with a letter.
`domainname`	The name of the DNS domain in which the computer is joined.
`windows/domain`	The name of the NetBIOS domain used by Samba. This variable should only by defined for the system role master domain controller.
`locales`	Localisation packages to be installed (locales). If more than one locale is specified, the locales are separated by blank spaces.
`locale/default`	The standard locale for the computer, e.g. `en_GB.UTF-8:UTF-8`. More information on system locales can be found at [locales].
`country`, `keymap`	The keyboard layout for the computer, specified in the form of an X11 keymap entry, e.g. `de-latin1`.
`timezone`	The time zone for the computer, e.g. `Europe/Berlin`. A complete list of possible configuration options is shown in the Basic settings module of the Univention Management Console.
`root_password`	The password for the root user for this computer. On a master domain controller, this password is also used for the Administrator's password.

§3.3.2. Profile variables - LDAP settings and domain joins

Automatically joining the computer into the domain is currently not supported for security reasons.

Table 3.2. Profile variables - LDAP settings and domain joins

Name	Function
`start/join`	As standard, all computers apart from the base system and master domain controller attempt to join the UCS domain in the course of the installation. If this parameter is set to `false`, the automatic domain join is deactivated.
`ldap/base`	The base DN of the LDAP domain. In general, the base DN `dc=example,dc=com` is used in a domain `example.com`. This variable is only evaluated on the system role master domain controller.

§3.3.3. Profile variables - Network configuration

By default automatically installed systems use DHCP. The following profile variables can be used to specify the network configuration of the computer.

General information on the network configuration and the use of the name servers can be found in Chapter Network configuration of the [ucs-manual].

The settings for network cards must be performed completely. It is not possible to leave individual settings blank. For example, if there is no IP address for the device eth0 in the profile, in addition to the IP address, the interfaces/eth0/netmask will also be requested.

Table 3.3. Profile variables - Network configuration

Name	Function
`interfaces/ethN/type`	If this parameter is set to `dynamic` or `dhcp`, the network interface `ethN` procures its network configuration via DHCP. The settings of `interfaces/ethN/ip`, `interfaces/ethN/netmask`, `interfaces/ethN/network`, `interfaces/ethN/broadcast`, `nameserverN` and `gateway` then become optional, but can still be used to over-write the configuration provided by DHCP. If no DHCP offer is received, a random IP address from the link-local network `169.254.x.x` is used.
`interfaces/ethN/ip`	The IPv4 address of the physical network interface `ethN`.
`interfaces/ethN/netmask`	The network mask of the subnetwork from which the IPv4 address of `ethN` originates.
`gateway`	The IPv4 address of the gateway which the computer should use as standard. Alternatively, one can specify the computer name or the FQDN that can be resolved into the IP address.
`interfaces/ethN/ip6`	The IPv6 address of the physical network interface `ethN` in static configuration.
`interfaces/ethN_prefix6`	The prefix of the IPv6 address of the physical network interface `ethN` in static configuration.
`ipv6/gateway`	The IPv6 address of the gateway which the computer should use as standard. It is not obligatory to enter a gateway for IPv6, but recommended. An IPv6 gateway configured here has preference over router advertisements, which might otherwise be able to change the route.
`interfaces/ethN/acceptra`	If this setting is set to `yes`, the stateless address auto-configuration (SLAAC) is used. In this, the IP address is assigned from the routers of the local network segment. If the variable is set to `no`, the configuration is performed statically via `interfaces/ethN/ip6` and `interfaces/ethN/prefix6` (see there).
`nameserver1`, `nameserver2`, `nameserver3`	The IP address of the name server which should perform the name resolution. It is possible to specify up to three name servers.
`dns/forwarder1`, `dns/forwarder2`, `dns/forwarder3`	The IP address of the name server intended to serve as the forwarder for a locally installed DNS service. It is possible to specify up to three forwarders.
`proxy/http`	The URL of a proxy server to be used when downloading accessing the Internet. The specified URL is adopted in the Univention Configuration Registry variables `proxy/http` and `proxy/ftp`. This setting is only required if packages are to be installed which download additional packages from external web servers; e.g., the installation program for the Flash plugin. Example: `proxy/http="http://proxy.example.com:8080"`

§3.3.4. Profile variables - Software selection

The following profile variables refer to software packages which are to be installed on the computer.

Table 3.4. Profile variables - Software selection

Name	Function
`packages_install`	This settings names packages which are additionally installed. If more than one package is specified, the packages are separated by blank spaces.
`packages_remove`	This settings names packages which should be removed. If more than one package is specified, the packages are separated by blank spaces.

§3.3.5. Profile variables - SSL

A SSL certification infrastructure is set up during installation of a master domain controller. If no settings are configured, automatic names are given for the certificate.

Table 3.5. Profile variables - SSL

Name	Function
`ssl/country`	The ISO country code of the certification body appearing in the certificate (root CA), specified with two capital letters.
`ssl/state`	The region, county or province that appears in the certificate of the root CA.
`ssl/locality`	Place appearing in the certificate of the root CA.
`ssl/organization`	Name of the organisation that appears in the certificate of the root CA.
`ssl/organizationalunit`	Name of the organisational unit or department of the organisation that appears in the certificate of the root CA.
`ssl/email`	E-mail address that appears in the certificate of the root CA.

§3.4. Network-based PXE installations with Univention Net Installer

Network-based, profile-based installations via PXE are performed with the Univention Net Installer, which can be set up using the package univention-net-installer. In addition, a DHCP and WWW server is required. If the DHCP server and the PXE server of the Univention Net Installer are operated on separate systems, the PXE server must be assigned via a DHCP boot policy.

Univention Net Installer supports both the interactive and profile-based installation. Any questions not answered in the pre-seed file forces the installer to interactive mode.

Univention Net Installer requires a local repository as a package source (see the software deployment chapter of the [ucs-manual]). The profiles should be copied into the directory /var/lib/univention-client-boot/preseed/ on the repository server, which is accessible through http://HOST-NAME/univention-client-boot/preseed/.

§3.4.1. Assignment of a computer for automatic installation

A computer to be installed via Univention Net Installer must firstly be registered in the computer management of the Univention Management Console. The following values must be set as a minimum:

Hostname (General tab)
MAC address (General tab)
IP address (General tab)
DNS forward and reverse zone entries (General tab)
DHCP service entry (General tab)

The (Re-)install on next boot option must now be activated in the Advanced settings tab under Deployment.

The name of the installation profile relative to /var/lib/univention-client-boot/preseed/ can be entered under Name of installation profile. As an alternative any other http server can be used as well, in which case an absolute URL must be given.

Options entered under Additional start options are passed on to the kernel in network-based installations, e.g., for the deactivation of ACPI during system start. This can also be used to specify other pre-seed variables on a host-by-host basis.

A PXE configuration file is created for every computer object under /var/lib/univention-client-boot/pxelinux.cfg/.

Tip

Several Univention Configuration Registry variable exist on the PXE server, which can be used to further customize the PXE configuration. Use ucr search ^pxe/ to get a list of them including a short description. Those values will only be used when next a PXE configuration file is generated.

It must be verified that the boot order in BIOS of the system to be installed prefers a PXE network boot over hard disks or CD-ROMs.

On the next restart of the computer it will boot via PXE and is installed via the network.

By default the (Re-)install on next boot option needs to be reset manually after the installation has finished. If the package univention-net-installer-daemon is installed on the server, the flag can be reset automatically.

Caution

If the univention-net-installer-daemon is not used, the option (Re-)install on next boot must be unset manually after the installation. Otherwise the computer will be reinstalled every time the host is booted!

§Bibliography

[ucs-manual] Univention GmbH. 2014. Univention Corporate Server - Manual for users and administrators. http://docs.univention.de/manual-4.0.html.

[locales] Debian Project. 2013. Locale - Debian Wiki. http://wiki.debian.org/Locale.

[d-i] Debian Project. 2013. Debian Installer - Automating the installation using pre-seeding.