Table of Contents
With Univention Corporate Server 4.0-4, the fourth point release of Univention Corporate Server (UCS) 4.0 is now available. It provides various improvements and bugfixes especially in the areas of Active Directory compatibility, and the UCS management system. All security updates released for UCS 4.0-3 are included in this update.
During the update some services in the domain may not be available, i.e. the update should occur in a maintenance window. It is recommended to test the update in a separate test environment prior to the actual update. The test environment should be identical to the production environment. Depending on the system performance, network connection and the installed software the update takes between 20 minutes and several hours.
In environments with more than one UCS system, the update order of the UCS systems must be borne in mind:
The authoritative version of the LDAP directory service is maintained on the master domain controller and replicated on all the remaining LDAP servers of the UCS domain. As changes to the LDAP schemes can occur during release updates, the master domain controller must always be the first system to be updated during a release update.
Starting with UCS 4.0 UCS, installation DVDs are only provided for the x86 64 bit architecture (amd64). Existing 32 bit UCS 3 systems can still be updated to UCS 4.0 through the online repository or by using update DVDs. The 32 bit architecture will be supported over the entire UCS 4 maintenance.
It must be checked whether sufficient disk space is available. A standard installation requires a minimum of 6 GB of disk space. Depending on the scope of the existing installation, the update will require about another 2 GB of disk space for downloading and installing all packages.
For the update, a login should be performed on the system's local console as user root, and the update should be initiated there.
Alternatively, the update can be conducted using Univention Management Console.
Remote updating via SSH is not recommended as this may result in the update procedure being cancelled, e.g., if the network connection is interrupted.
In consequence, this can affect the system severely.
If updating should occur over a network connection nevertheless, it must be verified that the update continues despite disconnection from the network.
This can be done, e.g., using the tools screen and at. These tools are installed on all system roles by default.
Following the update, new or updated join scripts need to be executed.
This can be done in two ways:
Either using the UMC module or by running the command univention-run-join-scripts as user root.
Subsequently the UCS system needs to be restarted.
Anonymous usage statistics on the use of Univention Management Console are collected when using the UCS Core Edition version of UCS (which is generally used for evaluating UCS). The modules opened are logged in an instance of the web traffic analysis tool Piwik. This makes it possible for Univention to tailor the development of Univention Management Console better to customer needs and carry out usability improvements.
This logging is only performed when the UCS Core Edition license is used. The license status can be verified via the menu entry of the user menu in the upper right corner of Univention Management Console. If is listed under , this version is in use. When a regular UCS license is used, no usage statistics are collected.
Independent of the license used, the statistics generation can be deactivated by setting the Univention Configuration Registry variable umc/web/piwik to false.
WebKit, Konqueror and QtWebKit are shipped in the maintained branch of the UCS repository, but not covered with security support. WebKit is primarily used for displaying HTML help pages etc. Firefox should be used as web browser.
Univention Management Console uses numerous JavaScript and CSS functions to display the web interface. Cookies need to be permitted in the browser. The following browsers are recommended:
Chrome as of version 33
Firefox as of version 24
Internet Explorer as of version 9
Safari and Safari Mobile as of version 7
Users with older browsers may experience display or performance problems.
Listed are the changes since UCS 4.0-3:
All security updates issued for UCS 4.0-3 are included:
directory/manager/web/widget/.*/ (Bug 39041).
mail/postfix/cron/recreate/dh/parameter is changed to not
recreate the DH parameters every night. The cronjob of existing installations is
not changed (Bug 37459).
mail/postfix/policy/listfilter led to the mail
server rejecting all emails. This has been fixed (Bug 39093).
apache2/hsts, apache2/hsts/max-age,
and apache2/hsts/includeSubDomains. See their description for
more details (Bug 37637).
sysprep join failed against Samba 4. This issue has been
fixed (Bug 39079).
testparm error message about the UCS default for winbind separator has been
relaxed to only issue a warning message (Bug 36581).
DC=DomainDnsZones and DC=ForestDnsZones are synchronized now
(Bug 34184).
DC=DomainDNSZones and DC=ForestDNSZones are synchronized now, this
is relevant in AD Takeover scenarios. For updated domains, this is not activated
(Bug 34184).
/etc/lsb-release
(Bug 37725).
sshd/MACs, sshd/Ciphers, and
sshd/KexAlgorithms (Bug 38609).
sshd/Protocol and
sshd/HostKey (Bug 38709).
sshd/banner has been fixed
(Bug 39166).
univention-openssh-recreate-host-keys now
re-creates all host key files supported by SSH (Bug 38710).
sshd/HostKey/rsa
(Bug 38711).
ntpd and ntpdate won't
collide with each other, when started in short succession (e.g. while booting)
(Bug 39299).