The following adjustments need to be made for an image that is to be used in Amazon EC2.

Amazon EC2 uses a PyGrub version which can only read the data format from GRUB 1 (menu.lst), whilst UCS uses GRUB 2 as the bootloader. The following Univention Configuration Registry variables can be used to generate the GRUB configuration in this format additionally. The bootloader configuration is also adapted:

DEV='/dev/xvda' GRUB='(hd0)'
grub-mkdevicemap ||
	echo "${GRUB} ${DEV}" >/boot/grub/device.map
append="$(ucr get grub/append |
	sed -re "s|/dev/sda|${DEV}|g;s|(no)?splash||g")"
xargs -d'\n' ucr set <<__UCR__
grub/append=${append}
grub/boot=${DEV}
grub/root=${DEV}1
grub/grub1root=${GRUB}
grub/bootsplash=no
grub/quiet=no
__UCR__
update-initramfs -uk all
update-grub
univention-grub-generate-menu-lst

The initial login to the EC2 instance is performed via a SSH host key. To prevent SSH logins from occurring with the default root password of the standard image during commissioning of the instance, the initial root password is removed. The following Univention Configuration Registry variable configures this start mode:

usermod -p \* root
ucr set server/amazon=true

The name server should be set; in this example to OpenDNS. Additionally, the timeout when waiting for a DHCP request answer is lowered.

ucr set nameserver1=208.67.222.222 dns/forwarder1=208.67.222.222
ucr unset nameserver2 nameserver3
ucr unset dns/forwarder2 dns/forwarder3
ucr set interfaces/eth0/type=dhcp dhclient/options/timeout=12

The provisioning for OpenStack images occurs via Cloud-Init (see Section 2.3.2). Cloud-Init is a standardized solution for configuration of an image. Cloud-Init checks a range of data sources for an existing configuration. The univention-cloud-init package must be installed to prepare an image for provisioning via Cloud-Init:

univention-install univention-cloud-init

The local Firefox session should not be started when running as an OpenStack instance.

ucr set system/setup/boot/start=false

The initial login to the OpenStack instance is performed via a SSH host key. To prevent SSH logins from occurring with the default root password of the standard image during commissioning of the instance, the initial root password is removed.

usermod -p \* root

Virtualization images for VirtualBox, VMware Player and VMware ESX can also be created on the basis of the qcow2 images above. To this end, Univention offers a tool, which can be installed via the generate-appliance package (the integration in UCS 4.1 can be followed via Bug 37137).

The generate_appliance tool must be started and the qcow2 image selected with the parameter -s:

generate_appliance -s appliance.qcow2

The virtual machine is assigned one CPU and a gigabyte of RAM as standard. If the appliance has a higher storage or CPU power requirement, the parameter -m can be used to specify a different quantity of RAM in megabytes and -c can be used to assign a different number of CPUs. The parameters --vendor and --product can be used to specify a vendor and product name.

In the default setting, three different virtualization images are generated from the qcow2 image. The generation for a type can be suppressed using the respectively given option:

Automatic configuration with the UCS appliance mode requires creating a profile file /var/cache/univention-system-setup/profile. Example configuration:

hostname="ucs"
domainname="testdom.local"
windows/domain="TESTDOM"
ldap/base="dc=testdom,dc=local"
root_password="univention"

locale/default="de_DE.UTF-8:UTF-8"
components="univention-s4-connector univention-samba4 univention-nagios-server"
packages_install="univention-s4-connector univention-samba4 univention-nagios-server"
packages_remove=""

server/role="domaincontroller_master"

interfaces/eth0/type=""
interfaces/eth0/address="10.201.101.2"
interfaces/eth0/netmask="255.0.0.0"
interfaces/eth0/network="10.0.0.0"
interfaces/eth0/broadcast="10.255.255.255"
dns/forwarder1="10.201.74.2"
gateway="10.201.0.1"

If interfaces/eth0/type is set to dynamic, DHCP is used for the network configuration.

Then the /usr/lib/univention-system-setup/scripts/setup-join.sh tool needs to be run once. Then Apache and the UMC server need to be restarted:

invoke-rc.d apache2 restart
invoke-rc.d univention-management-console-server restart

Cloud-Init works on a configuration file in the cloud configuration format. The configuration file is provided by the respective cloud service; the type of provision differs from cloud solution to cloud solution. It is currently only possible to provide a master domain controller.

The configuration file may be adapted for different scenarios. To setup a domain, the ucs_setup section is required. Note that the supplied ldap_base is used in other configuration sections as well.

The following includes an example file with which a master domain controller can be provided. In addition, several files are generated on the system: the UCS license to be installed and a file with the apps to be installed from the Univention App Center. The license in this example is the default core edition license. More information about requesting a proper license can be found in Section 2.3.3.

Two example hook scripts are generated which are called after setup is finished: One calls wget for a given URL, which could be used to signal an external service that the provisioning of the instance is done. The other is an example udm call to register an OpenStack connection in UVMM.

#cloud-config
#
ucs_setup:
  hostname: myucsmaster
  domainname: ucs.local
  windowsdomain: UCS
  ldap_base: dc=ucs,dc=local
  rootpassword: univention
  defaultlocale: de_DE.UTF-8:UTF-8
  components:
  packages_install: univention-virtual-machine-manager-daemon
  packages_remove:
write_files:
-   content: |
      dn: cn=admin,cn=license,cn=univention,dc=ucs,dc=local
      objectClass: top
      objectClass: univentionLicense
      objectClass: univentionObject
      univentionObjectType: settings/license
      univentionLicenseEndDate: unlimited
      univentionLicenseModule: admin
      cn: admin
      univentionLicenseBaseDN: UCS Core Edition
      univentionLicenseUsers: unlimited
      univentionLicenseServers: unlimited
      univentionLicenseManagedClients: unlimited
      univentionLicenseCorporateClients: unlimited
      univentionLicenseVirtualDesktopUsers: 0
      univentionLicenseVirtualDesktopClients: 0
      univentionLicenseSupport: 0
      univentionLicensePremiumSupport: 0
      univentionLicenseVersion: 2
      univentionLicenseType: UCS
      univentionLicenseSignature: ZjofoUmITUqpyF5q+AfE1i6EwsKXGWYnkh3JLJH3/bXqvD26nG
       aLa+cpcr6g9Stkx2Lslh1feGCpsdvowkA3T+SFtPHSX0Fds78QgyatoiFlA6mbbtMf3ABbMfW9Glt
       IZBbxxDFD+hMO/7yOHwaFZM3xb1I2ToJ1D2+xvOxrZe2SCZd4KJIXpupnmJnAC/D4Y9iqHPytVPU3
       QlI6zXnGU5q47RN/tdXLTpV7mHoiXRWh282TNOlnEiiQxwiQ4u2ghWE1x/EWY/CXvZm0PQcsFqGyB
       v72WdEUOex1Yuf3BgZ7QfLOQ2XIv6KPKCyYqZqlSNp8Xk+IpKjDqL+aq0oyeg==
    owner: root:root
    path: /var/cache/univention-system-setup/license
    permissions: '0400'
-   content: |
      simplesamlphp
      adconnector
    owner: root:root
    path: /var/cache/univention-system-setup/installapps
    permissions: '0400'
-   content: |
      #!/bin/sh
      wget http://myURL/page?myparam=myValue
    owner: root:root
    path: /usr/lib/univention-system-setup/appliance-hooks.d/90_wget_url
    permissions: '0755'
-   content: |
      #!/bin/sh
      udm uvmm/cloudconnection create --ignore_exists \
      --position="cn=CloudConnection,cn=Virtual Machine Manager,dc=ucs,dc=local" \
      --set name="OpenStack" \
      --set type="cn=OpenStack,cn=CloudType,cn=Virtual Machine Manager,dc=ucs,dc=local" \
      --set includeUCSimages=0 \
      --append parameter="username demouser" \
      --append parameter="password password" \
      --append parameter="cloudtype OpenStack" \
      --append parameter="auth_url http://192.168.0.1:5000" \
      --append parameter="auth_version 2.0_password" \
      --append parameter="service_type compute" \
      --append parameter="service_name nova" \
      --append parameter="tenant demotenant" \
      --append parameter="service_region regionOne"
      invoke-rc.d univention-virtual-machine-manager-daemon restart
    owner: root:root
    path: /usr/lib/univention-system-setup/appliance-hooks.d/80_add_uvmm_connection
    permissions: '0755'

The file with the apps to be installed contains a list of IDs of applications from the Univention App Center, see Section 2.2. The list in the example above installs the Univention AD Connector and the SAML integration on the provided master domain controller

In the default installation, a UCS installation has a core edition license. An updated license from Univention is required in order to use the App Center. For standard installations it is sent to the user by e-mail and then set up in the Univention Management Console.

Cloud service providers have the possibility of retrieving UCS licenses via an API, i.e., if a new instance is to be created for a customer, the license can be retrieved via the API and then installed in the provided instance directly.

Access to the license server requires a user name and a password. These can be requested from Univention at <sales@univention.de>. In this document, https://license.univention.de/shop/example/ is used as an example URL for the license server.

wget --keep-session-cookies --save-cookies cookie.db --load-cookies \
 cookie.db --post-data='username=univention&password=secret' \
 https://license.univention.de/shop/example/

wget --keep-session-cookies --save-cookies cookie.db --load-cookies cookie.db \
--post-data='kundeEmail=customer@example&'\
'kundeUnternehmen=New%20Customern&'\
'EndDate=27.11.2015&'\
'BaseDN=dc%3Ddrei%2Cdc%3Dzwei%2Cdc%3Dtest&'\
'Servers=0&'\
'Support=0&'\
'PremiumSupport=0&'\
'Users=100&'\
'ManagedClients=0&'\
'CorporateClients=0&'\
'VirtualDesktopUsers=0&'\
'VirtualDesktopClients=0&'\
'Type=UCS' \
https://license.univention.de/shop/example/order

...
<span id="orderid">21</span>
...

...
<span id="details">Not a valid date: u'27.11.201'</span>
...

wget --keep-session-cookies --save-cookies cookie.db --load-cookies cookie.db \
https://license.univention.de/shop/example/orders/465.ldif

The following profile variables can be used to specify basic properties of the computer such as the computer name, its role within the UCS domain and the name of the domain the computer should join.

Automatically joining the computer into the domain is currently not supported for security reasons.

By default automatically installed systems use DHCP. The following profile variables can be used to specify the network configuration of the computer.

General information on the network configuration and the use of the name servers can be found in Chapter Network configuration of the [ucs-manual].

The settings for network cards must be performed completely. It is not possible to leave individual settings blank. For example, if there is no IP address for the device eth0 in the profile, in addition to the IP address, the interfaces/eth0/netmask will also be requested.

The following profile variables refer to software packages which are to be installed on the computer.

A SSL certification infrastructure is set up during installation of a master domain controller. If no settings are configured, automatic names are given for the certificate.

A computer to be installed via Univention Net Installer must firstly be registered in the computer management of the Univention Management Console. The following values must be set as a minimum:

The (Re-)install on next boot option must now be activated in the Advanced settings tab under Deployment.

The name of the installation profile relative to /var/lib/univention-client-boot/preseed/ can be entered under Name of installation profile. As an alternative any other http server can be used as well, in which case an absolute URL must be given.

Options entered under additional start options are passed on to the kernel in network-based installations, e.g., for the deactivation of ACPI during system start. This can also be used to specify other pre-seed variables on a host-by-host basis. To perform an installation fully unattended see the explanations for the installation profile for a list of required options.

A PXE configuration file is created for every computer object under /var/lib/univention-client-boot/pxelinux.cfg/.

It must be verified that the boot order in BIOS of the system to be installed prefers a PXE network boot over hard disks or CD-ROMs.

On the next restart of the computer it will boot via PXE and is installed via the network.

By default the (Re-)install on next boot option needs to be reset manually after the installation has finished. If the package univention-net-installer-daemon is installed on the server, the flag can be reset automatically.