Table of Contents
With Univention Corporate Server 4.0-0, the fourth major release of Univention Corporate Server (UCS) is now available. It provides several substantial feature improvements and extensions, new properties as well as various improvements and bugfixes. An overview of the most important changes:
The design and the usability of the graphical administration interface Univention Management Console were completely revamped. By using a responsive design, Univention Management Console provides improved compatibility for tablets and smartphones.
In addition to local virtualization servers, the UCS Virtual Machine Manger (UVMM) can now also manage OpenStack or Amazon EC2 environments. This allows the setup of hybrid cloud scenarios out-of-the-box with UCS.
UCS 4.0 is based on Debian GNU/Linux 7.7 (Wheezy). More than 16,000 source packages were updated. Selected core components, e.g. OpenLDAP (2.4.40), Samba (4.2rc2) or the Linux kernel (3.16) are more recent in UCS compared to Debian GNU/Linux 7.7.
The installation of UCS has been simplified significantly. The base installation is now done using the Debian installer and it is concluded with a web-based configuration of the system. The same, web-based system is also used for the manual configuration of cloud images or other appliances.
The performance of the OpenLDAP directory service has been significantly improved. By default the memory-mapped storage backend (MDB) is now used when installing UCS.
The management of applications in the UCS domain has been simplified through a centralised App Center. This allows the installation of applications in the entire domain from a single system.
UCS now also supports the installation on systems using UEFI SecureBoot.
During the update some services in the domain may not be available, i.e. the update should occur in a maintenance window. It is recommended to test the update in a separate test environment prior to the actual update. The test environment should be identical to the production environment. Depending on the system performance, network connection and the installed software the update takes between 30 minutes and several hours.
In environments with more than one UCS system, the update order of the UCS systems must be borne in mind:
The authoritative version of the LDAP directory service is maintained on the master domain controller and replicated on all the remaining LDAP servers of the UCS domain. As changes to the LDAP schemes can occur during release updates, the master domain controller must always be the first system to be updated during a release update.
UCS 4.0 supports mixed operation with UCS 3.2-4 systems, i.e. not all systems must be updated in the same maintenance windows. Mixed operation with older UCS versions such as UCS 3.1 is not supported.
If applications have been installed from the Univention App Center, the update can only be performed once all installed applications are available in a compatible version. Some applications are updated to newer versions during the update. If an application is not yet available for UCS 4.0, the release date can be obtained from the application vendor.
If Univention Corporate Client 1.0 is in use and the update to Univention Corporate Client 2.0 should be performed at a later time, the update to the latest available Univention Corporate Client 1.0 version should be made before updating to UCS 4.0:
eval "$(ucr shell version/version version/patchlevel)" univention-add-app ucc_20140115 univention-upgrade --updateto $version_version-$version_patchlevel
A detailed overview of the changes can be found in the UCC 1.0 rev3 release notes: http://updates.software-univention.de/doc/release-notes-ucc-1.0-rev3.pdf.
The use of Windows NT domain services - as traditionally provided by Samba 3 - is no longer recommended with UCS 4.0. Windows NT domain services can no longer be selected during the installation of UCS and in the Univention App Center. We recommend the migration to the Active Directory domain services provided by Samba 4. The migration is documented in the Univention Wiki: http://wiki.univention.de/index.php?title=Migration_from_Samba_3_to_Samba_4.
Starting with UCS 4.0 UCS, installation DVDs are only provided for the x86 64 bit architecture (amd64). Existing 32 bit UCS 3 systems can still be updated to UCS 4.0 through the online repository or by using update DVDs. The 32 bit architecture will be supported over the entire UCS 4 maintenance.
It must be checked whether sufficient disk space is available. A standard installation requires a minimum of 6 GB of disk space. Depending on the scope of the existing installation, the update will require about another 4 GB of disk space for downloading and installing all packages.
For the update, a login should be performed on the system's local console as user
root, and the update should be initiated there. Alternatively, the
update can be conducted using Univention Management Console.
Remote updating via SSH is not recommended as this may result in the update procedure
being cancelled, e.g., if the network connection is interrupted. In consequence, this can affect
the system severely. If updating should occur over a network connection nevertheless, it must be
verified that the update continues despite disconnection from the network. This can be
done, e.g., using the tools screen and at.
These tools are installed on all system roles by default.
Some components have been removed and are not shipped any longer with UCS 4.0:
The Xen hypervisor has been removed and is no longer supported in the UCS Virtual Machine Manager. The migration to KVM is described in [ext-doc-uvmm].
The Scalix LDAP schema has been removed in UCS 4.0. All Scalix specific attributes need to be removed from the LDAP directory before updating.
PostgreSQL 8.3 is no longer provided in UCS 4.0. The migration of the databases to PostgreSQL 8.4 is described in SDB 1249.
Cyrus 2.2 is no longer provided in UCS 4.0. The migration of the mail spool to Cyrus 2.4 is described in SDB 1213.
Following the update, new or updated join scripts need to be executed. This can be done in
two ways: Either using the UMC module or by running the
command univention-run-join-scripts as user
root.
If the application UCS Virtual Machine Manager was used
with KVM virtualization servers, the new virtualization profiles need to be adapted for
UCS 4.0. If the bridge interface on the KVM servers wasn't configured as
br0, the profile should be adapted as documented in [ucs-uvmm-profile].
Subsequently the UCS system needs to be restarted.
The profile-based UCS network installation is not yet available in UCS 4.0-0. It will be provided at a later date. Please refer to our issue tracker for further details: Bug 35537.
Anonymous usage statistics on the use of Univention Management Console are collected when using the free for personal use version of UCS (which is generally used for evaluating UCS). The modules opened are logged in an instance of the web traffic analysis tool Piwik. This makes it possible for Univention to tailor the development of Univention Management Console better to customer needs and carry out usability improvements.
This logging is only performed when the free-for-personal-use license is used. The license status can be verified via the menu entry of the user menu in the upper right corner of Univention Management Console. If is listed under , this version is in use. When a regular UCS license is used, no usage statistics are collected.
Independent of the license used, the statistics generation can be deactivated by setting the
Univention Configuration Registry variable umc/web/piwik to false.
WebKit, Konqueror and QtWebKit are shipped in the maintained branch of the UCS repository, but not covered with security support. WebKit is primarily used for displaying HTML help pages etc. Firefox should be used as web browser.
Univention Management Console uses numerous JavaScript and CSS functions to display the web interface. Cookies need to be permitted in the browser. The following browsers are recommended:
Chrome as of version 33
Firefox as of version 24
Internet Explorer as of version 9
Safari and Safari Mobile as of version 7
Users with older browsers may experience display or performance problems.
Listed are the changes since UCS 3.2-4:
update40/skip/openjdk7 to
true (Bug 35382).
grub/gfxmode) is now
set to "text", otherwise the grub menu is invisible
(Bug 30978).
ldap/database/type. The backend is
not changed during the update. More information about MDB can be found in the
performance guide: [ucs-performance-guide]
(Bug 34994,
Bug 36725).
ldap/ppolicy
and ldap/ppolicy/enabled to yes and
restarting the slapd daemon. The default policy is such that
5 repeated LDAP authentication failures within a monitoring interval
of 5 minutes causes the authenticating account to be locked in UDM.
A locked account can only be unlocked via UDM by a Domain Admin.
The number of repeated LDAP authentication failures can be adjusted
in the configuration object which has the objectClass pwdPolicy.
The attribute pwdMaxFailure determines the number of LDAP
authentication errors before lockout. The attribute pwdMaxFailure
determines the time interval in seconds which is considered: LDAP authentication
failures outside of that interval are neglected in the counting.
Other attributes of this objectclass should not be adjusted
(Bug 31907).
univention.uldap removes the base
object from the search result if the search scope one was used. Thus
the behavior is identical between BDB and MDB
(Bug 36169).
shadowMax, shadowExpire
and univentionUDMOptionModule have been added
(Bug 36215,
Bug 36671,).
windows/domain is derived from the domain name
it is automatically truncated to up to 15 characters to conform to netbios
restrictions (Bug 36459).
preup.sh and postup.sh
have been adapted to the needs of UCS 4.0
(
Bug 36205,
Bug 36218,
Bug 36228,
Bug 36229,
Bug 36441,
Bug 36455,
Bug 36554,
Bug 36558,
Bug 36618,
Bug 36619,
Bug 36620,
Bug 36769
).
apt-get autoremove to
deinstall obsolete packages (e.g. packages that were automatically installed
but are now no longer referenced by other packages). This can be disabled by setting
the Univention Configuration Registry variable update40/skip/autoremove to true.
(Bug 36265).
univention-repository-create is still able to create a local
repository from any type of UCS DVD (old or new data structure). But as of UCS 4.0 the PXE
installation of UCS system prior to UCS 4 is no longer supported. Therefore
univention-repository-create will not copy PXE installation data from UCS DVDs
with old data structure (Bug 36269).
univention.uldap implementation to retry failed connects too many times.
This has been fixed (Bug 35841, Bug 35852).
univention.uldap resulted in
invalid access errors in the S4 Connector after a samba restart.
To avoid this, the S4 Connector turns off the reconnect feature for the access
to the samba directory service (Bug 36227).
mail/postfix/smtpd/tls/eecdh/grade and
mail/postfix/tls/preempt/cipherlist have been added
to allow better configuration of postfix's perfect forward secrecy
(Bug 35923).
mail/antivir/spam to false
after the update
(Bug 36524).
mail/alias/* variables are set
(Bug 31837).
net idmap secret has been renamed to net idmap set secret
(Bug 35765).
SMB_CONF_PATH is set during the
univention-samba join to ensure the right configuration is used
(Bug 36734).
SMB_CONF_PATH is set during the
univention-samba4 join to ensure the right configuration is used
(Bug 36806).
windows/wins-support was not set samba complained about
an empty value in smb.conf This has been fixed
(Bug 33261).
smb.conf validation code complained about empty values in smb.conf
(Bug 36814).
dns/forwarder*
Univention Configuration Registry settings from the DC master will be copied to the joining system
(Bug 36245).
xorg/keyboard/options/XkbModel,
xorg/keyboard/options/XkbLayout and
xorg/keyboard/options/XkbVariant. The old
Univention Configuration Registry variable locale/keymap has been removed
(Bug 35709).
[ext-doc-uvmm] Univention GmbH. 2014. Extended virtualization documentation. https://docs.software-univention.de/uvmm-4.0.html.
[ucs-uvmm-profile] Univention GmbH. 2014. UCS manual - Virtualization - Profiles. https://docs.software-univention.de/manual-4.0.html#uvmm::profile::network.
[ucs-performance-guide] Univention GmbH. 2014. UCS performance guide. https://docs.software-univention.de/performance-guide-4.0.html.