Table of Contents
With Univention Corporate Server 4.3, the third minor release of Univention Corporate Server (UCS) 4 is now available. It provides several feature improvements and extensions, new properties as well as various improvements and bugfixes. Here is an overview of the most important changes:
UCS 4.3 is based on Debian GNU/Linux 9 (Stretch). More than 20,000 source packages have been updated and and some have been adapted to the needs of UCS users. The Linux kernel of Debian GNU/Linux is now used unmodified. This greatly improves compatibility to hardware and software which has been certified for Debian 9. Also new in UCS 4.3 are e.g. MariaDB and Nagios 4.
The portal pages introduced with the UCS 4.2 give users a simple way to access applications relevant to them. With UCS 4.3, administrators can easily build and manage these portals in visual composer mode and via drag and drop. It is now also possible to show different content to different users, depending on their group membership, permissions, department, branch or school.
With UCS 4.3, SAML authentication is linked to the Kerberos login. Users logged in to Windows or Linux (Ubuntu) can access Web applications that support SAML without re-authentication.
The different account types for users have been simplified. There are now three different account types with UCS 4.3:
Normal accounts containing all features.
Simple authentication accounts, these can only connect to LDAP servers, but have no possibility to log in elsewhere.
Address book entries for maintaining contact information.
Samba has been updated to version 4.7. This new Samba release contains important enhancements to the Active Directory domain controller. For example, the multi process implementation of the Samba LDAP server will significantly improve performance. Additionally, replicating group memberships now uses significantly fewer resources.
During the update some services in the domain may not be available temporarily, that is why the update should occur in a maintenance window. It is recommended to test the update in a separate test environment prior to the actual update. The test environment should be identical to the production environment. Depending on the system performance, network connection and the installed software the update will take between 20 minutes and several hours.
In environments with more than one UCS system, the update order of the UCS systems must be borne in mind:
The authoritative version of the LDAP directory service is maintained on the master domain controller and replicated to all the remaining LDAP servers of the UCS domain. As changes to the LDAP schema can occur during release updates, the master domain controller must always be the first system to be updated during a release update.
Starting with UCS 4.0, installation DVD are only provided for the x86 64 bit architecture (amd64). Existing 32 bit UCS 3 systems can still be updated to UCS 4.0 through the online repository or by using update DVD. The 32 bit architecture will be supported over the entire UCS 4 maintenance period.
It must be checked whether sufficient disk space is available. A standard installation requires a minimum of 6 GB of disk space. Depending on the scope of the existing installation, the update will require about another 2 GB of disk space for download and installation all packages.
For the update, a login should be performed on the system's local console as user root, and the update should be initiated there.
Alternatively, the update can be conducted using Univention Management Console.
Remote updating via SSH is not recommended as this may result in the update procedure being canceled, e.g., if the network connection is interrupted.
In consequence, this can affect the system severely.
If updating should occur over a network connection nevertheless, it must be verified that the update continues in case of disconnection from the network.
This can be achieved, e.g., using the tools screen and at. These tools are installed on all UCS system roles by default.
With UCS 4.3, Univention provides a script that checks for problems which would prevent the successful update of the system. Prior to the update, this script can be downloaded and executed on the UCS system.
# download
-> curl -OOs http://updates.software-univention.de/download/univention-update-checks/pre-update-checks-4.3{,.gpg}
# run script
-> gpgv --keyring /usr/share/keyrings/univention-archive-key-ucs-4x.gpg \
pre-update-checks-4.3.gpg pre-update-checks-4.3 && bash pre-update-checks-4.3
gpgv: Signature made Wed Mar 7 13:36:51 2018 CET using RSA key ID 6B8BFD3C
gpgv: Good signature from "Univention Corporate Server 4.x <packages@univention.de>"
Starting pre-update checks (Mon Mar 12 09:15:34 CET 2018):
Checking app_appliance ... OK
Checking block_update_of_NT_DC ... OK
Checking cyrus_integration ... OK
Checking disk_space ... OK
Checking hold_packages ... OK
Checking ldap_connection ... OK
Checking ldap_schema ... OK
...
Following the update, new or updated join scripts need to be executed.
This can be done in two ways:
Either using the UMC module or by running the command
univention-run-join-scripts as user root.
Subsequently the UCS system needs to be restarted.
UCS 4.3 replaces MySQL with MariaDB. The new package univention-mariadb provides the integration into UCS. The package univention-mysql is now a meta package and installs univention-mariadb. Existing data is migrated without user interaction when updating to UCS 4.3.
Previously, UMC administrators could assign certain properties to users, e.g. Samba, Kerberos, POSIX and Mail. With UCS 4.3, the existing users will be migrated to three different user types: 1. Normal full-fledged users, these have all features. 2. Simple authentication accounts, these can only connect to LDAP, but cannot log in elsewhere. 3. Address book entries - internal or external identities can be maintained here, e.g. to create address lists.
The integration of the Cyrus IMAP and POP3 server has been removed from UCS. The integration of Dovecot will be the only one supported from UCS 4.3 on. If you are using Cyrus on UCS 4.2 and wish to upgrade to UCS 4.3, please refer to the article https://help.univention.com/t/7957. The article includes a link to instructions for migrating from Cyrus to Dovecot.
Support for Windows NT style domain control has been removed from UCS 4.3. The update for
these domains is blocked and the domain needs to be migrated to Samba/AD
following the update guide Migration from Samba 3 to Samba 4.
See also Best practices for Samba 4 Migration .
Anonymous usage statistics on the use of Univention Management Console are collected when using the UCS Core Edition. The modules opened get logged to an instance of the web traffic analysis tool Piwik. This makes it possible for Univention to tailor the development of Univention Management Console better to customer needs and carry out usability improvements.
This logging is only performed when the UCS Core Edition license is used. The license status can be verified via the menu entry of the user menu in the upper right corner of Univention Management Console. If is listed under , this version is in use. When a regular UCS license is used, no usage statistics are collected.
Independent of the license used, the statistics generation can be deactivated by setting the Univention Configuration Registry variable umc/web/piwik to false.
WebKit, Konqueror and QtWebKit are shipped in the maintained branch of the UCS repository, but not covered by security support. WebKit is primarily used for displaying HTML help pages etc. Firefox should be used as web browser.
Univention Management Console uses numerous JavaScript and CSS functions to display the web interface. Cookies need to be permitted in the browser. The following browsers are recommended:
Chrome as of version 37
Firefox as of version 38
Internet Explorer as of version 11
Safari and Safari Mobile as of version 9
Users running older browsers may experience display or performance issues.
Listed are the changes since UCS 4.2-3:
service instead
of invoke-rc.d to restart services. This is necessary for the services to be
restarted during the UCS installation (Bug 45905, Bug 46055).
XS-Python-Version and XB-Python-Version have been removed from all packages(Bug 43336).
interfaces/primary is set during system setup (Bug 45956, Bug 46551).
ucr set ssl/default/hashfunction=sha256.
The certificate needs to be renewed afterwards.
For details see Renewing the SSL certificate.
krb5-kdc.schema has a new attribute krb5ExtendedAttributes (Bug 45996).
/etc/krb5.conf has been adjusted
to also set Heimdal specific options like default_etypes>. This ensures compatibility with domain controllers
in the UCS domain that have not been updated to UCS 4.3 yet (Bug 36542, Bug 46292).
apt-get directly, instead of using a library and implement the functionality (Bug 43660).
/var/log/univention/appcenter.log is now rotated (Bug 46274).
text/xml input data (Bug 45941).
Accept). The daemon in upstreams version sets it to Drop (Bug 46612).
/etc/nagios3/ to
/etc/nagios/. Also the cache and log directories have been renamed to
/var/cache/nagios/ and /var/log/nagios/. During the update,
all files from /etc/nagios3/conf.local.d/ and /etc/nagios3/conf.univention.d/
and the log and cache files are moved to the new directories to ensure a smooth transition. Nevertheless, the
Nagios configuration should be manually checked after the update (nagios -v /etc/nagios/nagios.cfg).
nagios.log have been changed to 640 (Bug 46306).
mpm_prefork handling and Univention Configuration Registry templates in univention-apache has been
adapted to Debian Stretch (Bug 45857, Bug 46065).
apache2/ssl/v3 has been removed (Bug 45922).
php/memory/limit, php/limit/postsize, php/limit/filesize,
php/limit/inputtime, php/memory/executiontime and php/limit/sockettimeout
to configure the php.ini have been removed. To configure PHP settings
/etc/php/7.0/apache2/php.ini or /etc/php5/apache2/php.ini
can be modified manually (Bug 46121).
update43/ignore_cyrus_check to yes.
Be advised that such a system is not supported by Univention.
Such a system may not be able to store received email, even if Cyrus is still running, as the legacy Cyrus integration will not create mailboxes for new users.
mailquota policy and its associated UDM module have been removed.
The Dovecot integration requires the quota information be set directly on the user object
(see UCS manual, section "Mail quota").
The names of the UDM properties for the mail quota have been changed to be vendor neutral. This is only noticeable when setting the quota via command line or via Python.
users/user) has been renamed from UniventionDovecotUserQuota to mailUserQuota.
mail/folder) has been renamed from cyrus-userquota to mailQuota.
If custom shell or Python scripts that change quota setting using UDM are in use, they must be modified to use the new names or they will not work anymore.
sieve_dir has been removed, as it is now part of the configuration value
of sieve (see conf.d/90-sieve.conf).
sieve_global_dir has been renamed to sieve_global
(see conf.d/90-sieve.conf).
/etc/postfix/dynamicmaps.cf has changed in Postfix 3.
The file will be saved to /etc/postfix/dynamicmaps.cf.postfix2.XXXXXXXX
(with XXXXXXXX being a random string) and removed before upgrading. The Postfix 3
packages will recreate it in the new format during the upgrade to UCS 4.3 (Bug 45968).
sa-update has been improved, which is done automatically during the installation of the package,
to ensure that a current ruleset for SpamAssassin is available after the installation (Bug 46555)
/etc/squid3 to /etc/squid. This includes the Univention Configuration Registry variable template /etc/squid/squid.conf
but also user configurations like /etc/squid/local.conf, /etc/squid/local_rules.conf etc..
All old configuration files are saved before the update in the directory /etc/squid3-update-4.3 (Bug 45935).
UCS-4.3.
Profiles for Windows Server 2003 are no longer created.
Individual profiles for previous UCS releases are no longer created in favor
of a generic profile for UCS-4.
The default boot order has been swapped to hard-disk before CD-ROM (Bug 46119).
NT style domain control has been removed in most parts. The update for these domains is
blocked and the domain needs to be migrated to Samba/AD following the update guide
Migration from Samba 3 to Samba 4.
See also Best practices for Samba 4 Migration (Bug 46118).
init.d script for smbd in univention-samba have been improved (Bug 46437).
SSH v.1 protocol has been removed.
Many legacy algorithms have been disabled, as they are considered cryptographically weak nowadays.
The Univention Configuration Registry template file for openssh has been updated accordingly:
The deprecated Univention Configuration Registry variables sshd/Protocol and sshd/ServerKeyBits have been removed.
The privilege separation mode has been changed to the new default sandbox.
All other settings have been reviewed and reset to their default value if appropriate (Bug 46033).
systemctl from reporting a wrong status for the services
univention-bind, univention-dhcp,
univention-directory-notifier and univention-directory-listener,
the runsv timeout has been increased to 30 seconds (Bug 46310, Bug 46311, Bug 46312, Bug 46313).
univention-directory-listener is now properly re-started in
univention-directory-replication-resync (Bug 46372).
ntp init script has been removed from univention-base-files.
Instead the systemd script provided by ntp is being used (Bug 46071).
/dev/urandom again instead of /dev/random (Bug 46260).
interfaces/*/network and interfaces/*/broadcast (Bug 46515).