UCS 4.2-5 Release Notes

Release notes for the installation and update of Univention Corporate Server (UCS) 4.2-5

Table of Contents

1. Release Highlights
2. Notes about the update
2.1. Recommended update order for environments with more than one UCS server
2.2. UCS installation DVD only available for 64 bit
3. Preparation of update
4. Postprocessing of the update
5. Further notes on selected packages
5.1. Collection of usage statistics
5.2. Scope of security support for WebKit, Konqueror and QtWebKit
5.3. Recommended browsers for the access to Univention Management Console
6. Changelog
6.1. General
6.2. Basic system services
6.2.1. Linux kernel and firmware packages
6.2.2. Univention Configuration Registry Changes to templates and modules
6.3. Univention Management Console
6.3.1. Univention Management Console server
6.3.2. Univention App Center
6.3.3. Modules for system settings / setup wizard
6.3.4. Domain join module
6.3.5. Software update module
6.3.6. Other modules
6.4. System services
6.4.1. Cyrus
6.4.2. Dovecot
6.4.3. Postfix
6.4.4. Apache
6.5. Virtualization
6.5.1. Univention Virtual Machine Manager (UVMM)
6.6. Services for Windows
6.6.1. Samba
6.6.2. Univention S4 Connector
6.6.3. Univention Active Directory Connection
6.7. Other changes

§Chapter 1. Release Highlights

With Univention Corporate Server 4.2-5, the fifth Point-Release for Univention Corporate Server (UCS) 4.2 is now available. It includes various detail improvements and bug fixes, especially in the areas of Active Directory Compatibility and UCS Management System. The security updates released for UCS 4.2-4 are included in this update.

§Chapter 2. Notes about the update

During the update some services in the domain may not be available temporarily, that is why the update should occur in a maintenance window. It is recommended to test the update in a separate test environment prior to the actual update. The test environment should be identical to the production environment. Depending on the system performance, network connection and the installed software the update will take between 20 minutes and several hours.

§2.1. Recommended update order for environments with more than one UCS server

In environments with more than one UCS system, the update order of the UCS systems must be borne in mind:

The authoritative version of the LDAP directory service is maintained on the master domain controller and replicated to all the remaining LDAP servers of the UCS domain. As changes to the LDAP schema can occur during release updates, the master domain controller must always be the first system to be updated during a release update.

§2.2. UCS installation DVD only available for 64 bit

Starting with UCS 4.0, installation DVD are only provided for the x86 64 bit architecture (amd64). Existing 32 bit UCS 3 systems can still be updated to UCS 4.0 through the online repository or by using update DVD. The 32 bit architecture will be supported over the entire UCS 4 maintenance period.

§Chapter 3. Preparation of update

It must be checked whether sufficient disk space is available. A standard installation requires a minimum of 6 GB of disk space. Depending on the scope of the existing installation, the update will require about another 1 GB of disk space for download and installation all packages.

For the update, a login should be performed on the system's local console as user root, and the update should be initiated there. Alternatively, the update can be conducted using Univention Management Console.

Remote updating via SSH is not recommended as this may result in the update procedure being canceled, e.g., if the network connection is interrupted. In consequence, this can affect the system severely. If updating should occur over a network connection nevertheless, it must be verified that the update continues in case of disconnection from the network. This can be achieved, e.g., using the tools screen and at. These tools are installed on all UCS system roles by default.

§Chapter 4. Postprocessing of the update

Following the update, new or updated join scripts need to be executed. This can be done in two ways: Either using the UMC module Domain join or by running the command univention-run-join-scripts as user root.

Subsequently the UCS system needs to be restarted.

§Chapter 5. Further notes on selected packages

§5.1. Collection of usage statistics

Anonymous usage statistics on the use of Univention Management Console are collected when using the UCS Core Edition (which is generally used for evaluating UCS). The modules opened are logged in an instance of the web traffic analysis tool Piwik. This makes it possible for Univention to tailor the development of Univention Management Console better to customer needs and carry out usability improvements.

This logging is only performed when the UCS Core Edition license is used. The license status can be verified via the menu entry License -> License information of the user menu in the upper right corner of Univention Management Console. If UCS Core Edition is listed under License type, this version is in use. When a regular UCS license is used, no usage statistics are collected.

Independent of the license used, the statistics generation can be deactivated by setting the Univention Configuration Registry variable umc/web/piwik to false.

§5.2. Scope of security support for WebKit, Konqueror and QtWebKit

WebKit, Konqueror and QtWebKit are shipped in the maintained branch of the UCS repository, but not covered by security support. WebKit is primarily used for displaying HTML help pages etc. Firefox should be used as web browser.

§5.3. Recommended browsers for the access to Univention Management Console

Univention Management Console uses numerous JavaScript and CSS functions to display the web interface. Cookies need to be permitted in the browser. The following browsers are recommended:

  • Chrome as of version 37

  • Firefox as of version 38

  • Internet Explorer as of version 11

  • Safari and Safari Mobile as of version 9

Users with older browsers may experience display or performance issues.

§Chapter 6. Changelog

Listed are the changes since UCS 4.2-4:

§6.1. General

§6.2. Basic system services

§6.2.1. Linux kernel and firmware packages

  • New version to follow Debian changes (Bug 47544).

§6.2.2. Univention Configuration Registry

§ Changes to templates and modules

  • Univention Configuration Registry autostart variables are now correctly evaluated across all scopes (Bug 47260).

§6.3. Univention Management Console

§6.3.1. Univention Management Console server

  • Fix memory leak caused by Python notifier traceback handling (Bug 47569).
  • In certain situations after reloading the browser window the error message There are no modules available for the currently authenticated user was incorrectly displayed (Bug 46998).
  • A problem with the SAML authentication which could lead to the Univention Management Console web interface becoming unresponsive has been fixed (Bug 47109).

§6.3.2. Univention App Center

  • Fix memory leak caused by Python notifier traceback handling (Bug 47569).
  • The command univention-app took every App from every UCS version into (Bug 47207).

§6.3.3. Modules for system settings / setup wizard

  • Fix memory leak caused by Python notifier traceback handling (Bug 47569).

§6.3.4. Domain join module

  • Fix memory leak caused by Python notifier traceback handling (Bug 47569).

§6.3.5. Software update module

  • The updater message for UCS releases that receive extended maintenance was clarified (Bug 45672).

§6.3.6. Other modules

  • Fix a memory leak preventing the Python garbage collector from freeing UCS Virtual Machine Manager connection instances (Bug 47569).

§6.4. System services

§6.4.1. Cyrus

  • The PAM stack has been fixed to allow the login via username (Bug 42759).

§6.4.2. Dovecot

  • The PAM stack has been fixed to allow the login via username (Bug 42759).

§6.4.3. Postfix

  • The PAM stack has been fixed to allow the login via username (Bug 42759).

§6.4.4. Apache

  • Added headers X-Forwarded-Proto and X-Forwarded-SSL so that certain Apps work correctly behind a proxy (Bug 47071).

§6.5. Virtualization

§6.5.1. Univention Virtual Machine Manager (UVMM)

  • The hosts in the dialog Migrate domain are now sorted (Bug 47342).
  • Make CPU-Usage column visibility configurable. The visibility is controlled by the Univention Configuration Registry variable uvmm/umc/showcpuusage (Bug 47137).
  • Update to VirtIO driver for Windows to version 0.1.141-1 (Bug 47112).

§6.6. Services for Windows

§6.6.1. Samba

  • After a server password change restart all of samba, not just the AD/DC component (Bug 47637).
  • Adjust default for Univention Configuration Registry variable samba/ntlm/auth (ntlm auth) to ntlmv2-only (Bug 47100).
  • Update package tevent to version 0.9.34 as required by Samba 4.6.15 (Bug 47429).
  • When joining a new Samba/AD DC, Samba replicates all LDAP partitions independently. Depending on timing the replication of the linked attribute serverReference could fail, if CN=Configuration gets replicated before the main domain partition. As a result DRS replication could fail (Bug 47749).
  • Fix regression: samba-tool ntacl sysvolcheck traceback due to /var/lib/samba/netlogon (Bug 47710).

§6.6.2. Univention S4 Connector

  • The Univention Directory Listener module now restarts the connector if extended attributes are modified (Bug 47048).
  • When objects are deleted or moved remove their DN from both group member mapping caches. This affected UCS@school (Bug 46971).

§6.6.3. Univention Active Directory Connection

  • The Univention Directory Listener module now restarts the connector if extended attributes are modified (Bug 47050).

§6.7. Other changes

  • If more than one hard disk drive is detected during UCS installation, the target disk for the grub installer can be selected Bug 47822.