UCS 4.3 Release Notes

Release notes for the installation and update of Univention Corporate Server (UCS) 4.3


Table of Contents

1. Release Highlights
2. Notes about the update
2.1. Recommended update order for environments with more than one UCS server
2.2. UCS installation DVD only available for 64 bit
3. Preparation of update
4. Postprocessing of the update
5. Notes on selected packages
5.1. MariaDB replaces MySQL
5.2. Simplify user options
5.3. Cyrus IMAP daemon
5.4. Samba as Windows NT DC
5.5. Collection of usage statistics
5.6. Scope of security support for WebKit, Konqueror and QtWebKit
5.7. Recommended browsers for the access to Univention Management Console
6. Changelog
6.1. General
6.2. Domain services
6.2.1. OpenLDAP
6.2.2. Kerberos
6.2.3. DNS server
6.3. Univention Management Console
6.3.1. Univention Management Console web interface
6.3.2. Univention Portal
6.3.3. Univention Management Console server
6.3.4. Univention App Center
6.3.5. Univention Directory Manager UMC modules and command line interface
6.3.6. Modules for system settings / setup wizard
6.3.7. Domain join module
6.3.8. System diagnostic module
6.3.9. Process overview module
6.3.10. Printers module
6.3.11. Univention Configuration Registry module
6.3.12. Other modules
6.4. Software deployment
6.5. System services
6.5.1. MySQL and MariaDB
6.5.2. Docker
6.5.3. SAML
6.5.4. Nagios
6.5.5. Apache
6.5.6. Radius
6.5.7. Cyrus
6.5.8. Dovecot
6.5.9. Postfix
6.5.10. ClamAV
6.5.11. SpamAssassin
6.5.12. Proxy services
6.5.13. Celery services
6.6. Desktop
6.7. Virtualization
6.7.1. Univention Virtual Machine Manager (UVMM)
6.8. Services for Windows
6.8.1. Samba
6.8.2. Univention S4 Connector
6.8.3. Univention Active Directory Connection
6.9. Other changes

§Chapter 1. Release Highlights

With Univention Corporate Server 4.3, the third minor release of Univention Corporate Server (UCS) 4 is now available. It provides several feature improvements and extensions, new properties as well as various improvements and bugfixes. Here is an overview of the most important changes:

  • UCS 4.3 is based on Debian GNU/Linux 9 (Stretch). More than 20,000 source packages have been updated and and some have been adapted to the needs of UCS users. The Linux kernel of Debian GNU/Linux is now used unmodified. This greatly improves compatibility to hardware and software which has been certified for Debian 9. Also new in UCS 4.3 are e.g. MariaDB and Nagios 4.

  • The portal pages introduced with the UCS 4.2 give users a simple way to access applications relevant to them. With UCS 4.3, administrators can easily build and manage these portals in visual composer mode and via drag and drop. It is now also possible to show different content to different users, depending on their group membership, permissions, department, branch or school.

  • With UCS 4.3, SAML authentication is linked to the Kerberos login. Users logged in to Windows or Linux (Ubuntu) can access Web applications that support SAML without re-authentication.

  • The different account types for users have been simplified. There are now three different account types with UCS 4.3:

    • Normal accounts containing all features.

    • Simple authentication accounts, these can only connect to LDAP servers, but have no possibility to log in elsewhere.

    • Address book entries for maintaining contact information.

  • Samba has been updated to version 4.7. This new Samba release contains important enhancements to the Active Directory domain controller. For example, the multi process implementation of the Samba LDAP server will significantly improve performance. Additionally, replicating group memberships now uses significantly fewer resources.

§Chapter 2. Notes about the update

During the update some services in the domain may not be available temporarily, that is why the update should occur in a maintenance window. It is recommended to test the update in a separate test environment prior to the actual update. The test environment should be identical to the production environment. Depending on the system performance, network connection and the installed software the update will take between 20 minutes and several hours.

§2.1. Recommended update order for environments with more than one UCS server

In environments with more than one UCS system, the update order of the UCS systems must be borne in mind:

The authoritative version of the LDAP directory service is maintained on the master domain controller and replicated to all the remaining LDAP servers of the UCS domain. As changes to the LDAP schema can occur during release updates, the master domain controller must always be the first system to be updated during a release update.

§2.2. UCS installation DVD only available for 64 bit

Starting with UCS 4.0, installation DVD are only provided for the x86 64 bit architecture (amd64). Existing 32 bit UCS 3 systems can still be updated to UCS 4.0 through the online repository or by using update DVD. The 32 bit architecture will be supported over the entire UCS 4 maintenance period.

§Chapter 3. Preparation of update

It must be checked whether sufficient disk space is available. A standard installation requires a minimum of 6 GB of disk space. Depending on the scope of the existing installation, the update will require about another 2 GB of disk space for download and installation all packages.

For the update, a login should be performed on the system's local console as user root, and the update should be initiated there. Alternatively, the update can be conducted using Univention Management Console.

Remote updating via SSH is not recommended as this may result in the update procedure being canceled, e.g., if the network connection is interrupted. In consequence, this can affect the system severely. If updating should occur over a network connection nevertheless, it must be verified that the update continues in case of disconnection from the network. This can be achieved, e.g., using the tools screen and at. These tools are installed on all UCS system roles by default.

With UCS 4.3, Univention provides a script that checks for problems which would prevent the successful update of the system. Prior to the update, this script can be downloaded and executed on the UCS system.

# download
-> curl -OOs http://updates.software-univention.de/download/univention-update-checks/pre-update-checks-4.3{,.gpg}

# run script
-> gpgv --keyring /usr/share/keyrings/univention-archive-key-ucs-4x.gpg \
        pre-update-checks-4.3.gpg pre-update-checks-4.3 && bash pre-update-checks-4.3

gpgv: Signature made Wed Mar  7 13:36:51 2018 CET using RSA key ID 6B8BFD3C
gpgv: Good signature from "Univention Corporate Server 4.x <packages@univention.de>"

Starting pre-update checks (Mon Mar 12 09:15:34 CET 2018):

Checking app_appliance ...                        OK
Checking block_update_of_NT_DC ...                OK
Checking cyrus_integration ...                    OK
Checking disk_space ...                           OK
Checking hold_packages ...                        OK
Checking ldap_connection ...                      OK
Checking ldap_schema ...                          OK
...

§Chapter 4. Postprocessing of the update

Following the update, new or updated join scripts need to be executed. This can be done in two ways: Either using the UMC module Domain join or by running the command univention-run-join-scripts as user root.

Subsequently the UCS system needs to be restarted.

§Chapter 5. Notes on selected packages

§5.1. MariaDB replaces MySQL

UCS 4.3 replaces MySQL with MariaDB. The new package univention-mariadb provides the integration into UCS. The package univention-mysql is now a meta package and installs univention-mariadb. Existing data is migrated without user interaction when updating to UCS 4.3.

§5.2. Simplify user options

Previously, UMC administrators could assign certain properties to users, e.g. Samba, Kerberos, POSIX and Mail. With UCS 4.3, the existing users will be migrated to three different user types: 1. Normal full-fledged users, these have all features. 2. Simple authentication accounts, these can only connect to LDAP, but cannot log in elsewhere. 3. Address book entries - internal or external identities can be maintained here, e.g. to create address lists.

§5.3. Cyrus IMAP daemon

The integration of the Cyrus IMAP and POP3 server has been removed from UCS. The integration of Dovecot will be the only one supported from UCS 4.3 on. If you are using Cyrus on UCS 4.2 and wish to upgrade to UCS 4.3, please refer to the article https://help.univention.com/t/7957. The article includes a link to instructions for migrating from Cyrus to Dovecot.

§5.4. Samba as Windows NT DC

Support for Windows NT style domain control has been removed from UCS 4.3. The update for these domains is blocked and the domain needs to be migrated to Samba/AD following the update guide Migration from Samba 3 to Samba 4. See also Best practices for Samba 4 Migration .

§5.5. Collection of usage statistics

Anonymous usage statistics on the use of Univention Management Console are collected when using the UCS Core Edition. The modules opened get logged to an instance of the web traffic analysis tool Piwik. This makes it possible for Univention to tailor the development of Univention Management Console better to customer needs and carry out usability improvements.

This logging is only performed when the UCS Core Edition license is used. The license status can be verified via the menu entry License -> License information of the user menu in the upper right corner of Univention Management Console. If UCS Core Edition is listed under License type, this version is in use. When a regular UCS license is used, no usage statistics are collected.

Independent of the license used, the statistics generation can be deactivated by setting the Univention Configuration Registry variable umc/web/piwik to false.

§5.6. Scope of security support for WebKit, Konqueror and QtWebKit

WebKit, Konqueror and QtWebKit are shipped in the maintained branch of the UCS repository, but not covered by security support. WebKit is primarily used for displaying HTML help pages etc. Firefox should be used as web browser.

§5.7. Recommended browsers for the access to Univention Management Console

Univention Management Console uses numerous JavaScript and CSS functions to display the web interface. Cookies need to be permitted in the browser. The following browsers are recommended:

  • Chrome as of version 37

  • Firefox as of version 38

  • Internet Explorer as of version 11

  • Safari and Safari Mobile as of version 9

Users running older browsers may experience display or performance issues.

§Chapter 6. Changelog

Listed are the changes since UCS 4.2-3:

§6.1. General

  • Debian packages have been updated to Debian Stretch (Bug 45642, Bug 45709, Bug 46328).
  • The packages univention-ldap, univention-directory-notifier, univention-bind, univention-heimdal, univention-postgresql and univention-appcenter now use the command service instead of invoke-rc.d to restart services. This is necessary for the services to be restarted during the UCS installation (Bug 45905, Bug 46055).
  • The Linux kernel from Debian is now used (Bug 45961).
  • XS-Python-Version and XB-Python-Version have been removed from all packages(Bug 43336).
  • The packages related to the DVD build process have been updated in order to work with Debian Stretch (Bug 45868).
  • A typing error in the welcome screen has been corrected (Bug 45819).
  • The Univention Configuration Registry variable interfaces/primary is set during system setup (Bug 45956, Bug 46551).
  • The update is stopped in case the system has a TLS certificate with a MD5 signature (Bug 46133). The hash algorithm can be set on the master domain controller with ucr set ssl/default/hashfunction=sha256. The certificate needs to be renewed afterwards. For details see Renewing the SSL certificate.

§6.2. Domain services

§6.2.1. OpenLDAP

  • OpenLDAP has been updated to version 2.4.45 (Bug 44834).
  • The krb5-kdc.schema has a new attribute krb5ExtendedAttributes (Bug 45996).
  • The test in the slapd's update scripts, whether the system is a UCS system, has been changed (Bug 45936).
  • Starting with UCS 4.3 the openldap overlay module for reverse group membership maintenance (memberOf) is activated by default for new installations, see the openldap documentation https://www.openldap.org/doc/admin24/overlays.html#Reverse Group Membership Maintenance for more information. This applies for new installations only, during the update to 4.3 the memberOf overlay module is installed but deactivated (if not already activated). Information on how to activate the memberOf overlay module can be found in https://help.univention.com/t/6439 (Bug 46066).

§6.2.2. Kerberos

  • For the update of Debian Heimdal to version 7.1, the Univention Configuration Registry Template for /etc/krb5.conf has been adjusted to also set Heimdal specific options like default_etypes>. This ensures compatibility with domain controllers in the UCS domain that have not been updated to UCS 4.3 yet (Bug 36542, Bug 46292).

§6.2.3. DNS server

  • The bind9 init script restarts the service only if the Univention Configuration Registry variable dns/backend is set (Bug 45341).
  • A memory leak and server crash has been fixed in the DNS server bind9 (Bug 46526).

§6.3. Univention Management Console

§6.3.1. Univention Management Console web interface

  • The package univention-web now depends on univention-apache (Bug 45893).
  • The installation and upgrade routines of univention-management-console-web-server check now if the Apache configuration if correct before restarting Apache (Bug 46467).

§6.3.2. Univention Portal

  • A module for easier configuration of portal and portal entry objects has been added to UMC. Additionally, portals can now be edited directly on the portal site itself (Bug 46270).
  • The visibility of individual portal entries may now be restricted to logged in users of a specific group (Bug 46336, Bug 46376).
  • The portal join script now checks the availability of the LDAP server much faster (Bug 45129).

§6.3.3. Univention Management Console server

  • In certain situations after reloading the browser window ,the error message "There are no modules available for the currently authenticated user" was incorrectly displayed. The behavior has been repaired (Bug 44068).

§6.3.4. Univention App Center

  • Non-Docker Apps are installed with a new functions. These functions support a wider range of integration (Bug 40064).
  • Packages are now installed via apt-get directly, instead of using a library and implement the functionality (Bug 43660).
  • The file /var/log/univention/appcenter.log is now rotated (Bug 46274).
  • Recommended Apps are now displayed with a badge in the App Center (Bug 46582).

§6.3.5. Univention Directory Manager UMC modules and command line interface

  • The UDM users/user options have been simplified by removing posix, samba, kerberos, mail and person. All objects handled by this UDM module will now have all object classes of these options. After the upgrade to UCS 4.3, all existing user objects, groups and user templates are migrated into the new LDAP format. It is necessary that the primary group of every user has the samba option enabled and the domain must have a Kerberos realm defined. The two previous options ldap_pwd and person are now handled as separate object types: A new UDM object type users/ldap has been added which can be used as a simple authentication account. User objects which had only the ldap_pwd option enabled are migrated into users/ldap objects. The UDM option ldap_pwd has been removed from user objects. Objects of users/ldap may authenticate via an LDAP bind. A new UDM object type users/contact has been added for address book objects. User objects which had only the person option enabled are migrated into users/contact objects. Objects of type users/contact and users/ldap are not counted into the license. Note: UCS systems which are older than UCS 4.3-0 may still create user objects in the old format and must be migrated. The UMC module System diagnosis and the script /usr/share/univention-directory-manager-tools/univention-migrate-users-to-ucs4.3 can be used to detect necessary changes and migrate user objects (Bug 45842, Bug 46261, Bug 46117, Bug 46357).
  • The disabled and locked choices in the users/user module have been simplified and adjusted to match Active Directory concepts. Now, when an administrator disables and account, all methods for authentication get disabled (LDAP/POSIX, Kerberos, Samba). This is in line with the unification of UDM options for user accounts. The locked setting, which used to do similar things, has been replaced to show if an account has been locked out temporarily and to allow administrative unlocking. Temporary lockout of an account can happen in case a user exceeds a number of failed authentication attempts, if a corresponding domain wide policy setting has been defined by an administrator (Bug 39817, Bug 46544).
  • The values for the syntax class Country have been updated (Bug 45926).
  • The syntax class Base64Bzip2XML has been adjusted to allow text/xml input data (Bug 45941).
  • In certain situations after locking and unlocking a user object the password was accidentally modified to one of password, ********, {KINIT} or {SASL}. This problem has been corrected (Bug 45877, Bug 45879).
  • The robustness of the LDAP directory module has been improved: Corrupt objects will simply be ignored in the listing (Bug 46193).
  • The pwdChangeNextLogin user attribute toggled when a password was modified twice (Bug 46067).
  • The system user account ucs-sso will not consume a user license (Bug 46385).

§6.3.6. Modules for system settings / setup wizard

  • The script startxwithfirefox now starts services in a change root environment during the installation (Bug 45895).
  • During the setup, apache2 certificates are created in the directory /var/cache/univention-system-setup due to the PrivateTmp default setting of the apache2 systemd service (Bug 46052).

§6.3.7. Domain join module

  • It is now ensured that the univention-directory-listener is properly restarted during the join process (Bug 46276).

§6.3.8. System diagnostic module

  • The robustness of the diagnostic modules have been increased (Bug 46231).

§6.3.9. Process overview module

  • The module has been adjusted to the new API of python-psutil (Bug 45927).
  • The module's search query produces better results (Bug 33198).

§6.3.10. Printers module

  • Resting user quota for printers via UMC has been fixed (Bug 44721).

§6.3.11. Univention Configuration Registry module

  • Empty categories are now hidden in the module's search field (Bug 29733).

§6.3.12. Other modules

  • A warning has been added in the system services UMC module when stopping the service causes a interruption of the connection (Bug 26477).

§6.4. Software deployment

§6.5. System services

§6.5.1. MySQL and MariaDB

  • MySQL has been replaced with MariaDB. The package univention-mysql will now install a MariaDB server on UCS 4.3. The change is transparent, if the package univention-mysql was installed on UCS 4.2, MariaDB will be installed during the update. In contrast to the Debian defaults, UCS uses the MariaDB default values for the configuration options character-set-server (latin1) and collation-server (latin1_swedish_ci) (Bug 45876, Bug 46434, Bug 46435, Bug 46537).

§6.5.2. Docker

  • The Docker package differs from the upstream package. The Docker daemon process' code has been modified to keep the default policy of the packetfilters FORWARD chain (Accept). The daemon in upstreams version sets it to Drop (Bug 46612).

§6.5.3. SAML

  • The single sign-on provider integration in UCS, simplesamlphp, now supports authentication with a valid domain Kerberos ticket (Bug 33214, Bug 46451, Bug 46576).
  • A systemd script for the univention-saml instance of memcached has been added (Bug 45960).
  • The univention-saml configuration for stunnel4 has been adapted to Debian Stretch (Bug 45882).
  • Dependencies for the univention-saml have been adapted for php7.0 compatibility. The php5 module will get disabled on update, to avoid conflicts (Bug 46110, Bug 46267).
  • The update to UCS 4.3 is currently blocked if an adapted Single-Sign on configuration is detected. This is the case after the SDB article to configure SAML Single Sign-On as single server solution has been followed (Bug 46605).

§6.5.4. Nagios

  • Nagios has been updated to version 4.3.4 (Bug 45942). In this new version, the default configuration directory has changed from /etc/nagios3/ to /etc/nagios/. Also the cache and log directories have been renamed to /var/cache/nagios/ and /var/log/nagios/. During the update, all files from /etc/nagios3/conf.local.d/ and /etc/nagios3/conf.univention.d/ and the log and cache files are moved to the new directories to ensure a smooth transition. Nevertheless, the Nagios configuration should be manually checked after the update (nagios -v /etc/nagios/nagios.cfg).
  • Permissions for the nagios.log have been changed to 640 (Bug 46306).

§6.5.5. Apache

  • The package univention-apache now depends on apache2 (Bug 45893).
  • The mpm_prefork handling and Univention Configuration Registry templates in univention-apache has been adapted to Debian Stretch (Bug 45857, Bug 46065).
  • The Univention Configuration Registry variable apache2/ssl/v3 has been removed (Bug 45922).
  • The php dependencies have been removed from the univention-apache package. Also the Univention Configuration Registry variables php/memory/limit, php/limit/postsize, php/limit/filesize, php/limit/inputtime, php/memory/executiontime and php/limit/sockettimeout to configure the php.ini have been removed. To configure PHP settings /etc/php/7.0/apache2/php.ini or /etc/php5/apache2/php.ini can be modified manually (Bug 46121).
  • The installation and upgrade routines of univention-apache check now if the Apache configuration is correct before restarting Apache (Bug 46467).

§6.5.6. Radius

  • The univention-radius configuration has been adapted to Debian Stretch. Please check your radius configuration after the upgrade, freeradius changed some configuration parameters. It might be necessary to re-add your radius clients (Bug 46263).

§6.5.7. Cyrus

  • The integration of the Cyrus IMAP and POP3 server has been removed from UCS. The integration of Dovecot has reached feature parity and will be the only one supported from UCS 4.3 on.
  • If you are using Cyrus on UCS 4.2 and wish to upgrade to UCS 4.3, please refer to the article https://help.univention.com/t/7957. The article includes a link to instructions for migrating from Cyrus to Dovecot.
  • An upgrade from UCS 4.2 to UCS 4.3 will be prevented as long as the package univention-mail-cyrus is installed. To circumvent this test, set the Univention Configuration Registry variable update43/ignore_cyrus_check to yes. Be advised that such a system is not supported by Univention. Such a system may not be able to store received email, even if Cyrus is still running, as the legacy Cyrus integration will not create mailboxes for new users.
  • As part of the cleanup, following the removal of Cyrus from UCS, the mailquota policy and its associated UDM module have been removed. The Dovecot integration requires the quota information be set directly on the user object (see UCS manual, section "Mail quota").
  • The names of the UDM properties for the mail quota have been changed to be vendor neutral. This is only noticeable when setting the quota via command line or via Python.

    • The quota property of the users module (users/user) has been renamed from UniventionDovecotUserQuota to mailUserQuota.
    • The quota property of the IMAP folder module (mail/folder) has been renamed from cyrus-userquota to mailQuota.

    Note

    If custom shell or Python scripts that change quota setting using UDM are in use, they must be modified to use the new names or they will not work anymore.

§6.5.8. Dovecot

  • The package univention-mail-dovecot has updated the configuration files of Dovecot to match those of upstream version 2.2.27 (Bug 45966). User interaction is only needed if a local configuration has touched the following two configuration keys:
  • The configuration key sieve_dir has been removed, as it is now part of the configuration value of sieve (see conf.d/90-sieve.conf).
  • The configuration key sieve_global_dir has been renamed to sieve_global (see conf.d/90-sieve.conf).
  • Dovecot does not support SSLv2 anymore.

§6.5.9. Postfix

  • The package univention-mail-postfix has updated the configuration files and start script of Postfix to match those of upstream version 3.1.6 (Bug 45963).
  • The format of the configuration file /etc/postfix/dynamicmaps.cf has changed in Postfix 3. The file will be saved to /etc/postfix/dynamicmaps.cf.postfix2.XXXXXXXX (with XXXXXXXX being a random string) and removed before upgrading. The Postfix 3 packages will recreate it in the new format during the upgrade to UCS 4.3 (Bug 45968).

§6.5.10. ClamAV

  • The package univention-antivir-mail has updated the configuration files of ClamAV to match those of upstream version 0.99.2 (Bug 45969).

§6.5.11. SpamAssassin

  • In the package univention-spamassassassin the call of sa-update has been improved, which is done automatically during the installation of the package, to ensure that a current ruleset for SpamAssassin is available after the installation (Bug 46555)

§6.5.12. Proxy services

  • The Squid proxy server has been updated to version 3.5.23. During this update, all configuration files are moved from /etc/squid3 to /etc/squid. This includes the Univention Configuration Registry variable template /etc/squid/squid.conf but also user configurations like /etc/squid/local.conf, /etc/squid/local_rules.conf etc.. All old configuration files are saved before the update in the directory /etc/squid3-update-4.3 (Bug 45935).

§6.5.13. Celery services

  • The package univention-celery provides dependencies and templates for software that wants to use the Celery service (an asynchronous task queue, http://www.celeryproject.org/ ( Bug 45030)).

§6.6. Desktop

  • The package univention-kde has been adapted for KDE Plasma 5 (Bug 46253).
  • Package dependencies have been updated in univention-kde (Bug 45943).
  • The package univention-mozilla-firefox has been adapted for Firefox 52 (Bug 45863, Bug 45864).

§6.7. Virtualization

§6.7.1. Univention Virtual Machine Manager (UVMM)

  • Qemu has been re-compiled to use newer libraries from UCS-4.3. Profiles for Windows Server 2003 are no longer created. Individual profiles for previous UCS releases are no longer created in favor of a generic profile for UCS-4. The default boot order has been swapped to hard-disk before CD-ROM (Bug 46119).
  • The UVMM unjoin script can now be executed on a DC Slave (Bug 46578).

§6.8. Services for Windows

§6.8.1. Samba

  • Samba has been updated to version 4.7.5 (Bug 45326). The UCS firewall has been adjusted to also ACCEPT port 49152. For details see Samba 4.7 Features added/changed.
  • The Active Directory builtin account Console Logon is created now in OpenLDAP too (Bug 46107).
  • Support for NT style domain control has been removed in most parts. The update for these domains is blocked and the domain needs to be migrated to Samba/AD following the update guide Migration from Samba 3 to Samba 4. See also Best practices for Samba 4 Migration (Bug 46118).
  • The dependency hints in the init.d script for smbd in univention-samba have been improved (Bug 46437).
  • A timeout in AD-Takeover has been increased and the DNS service is restarted after the takeover (Bug 46105).
  • In AD-Takeover, the detection of the network interface, used to take over the AD server address, has been fixed (Bug 46105).

§6.8.2. Univention S4 Connector

  • The S4-Connector now synchronizes the account lockout state (Bug 32014).

§6.8.3. Univention Active Directory Connection

  • The Univention Active Directory Connector now supports Windows 2016 domains (Bug 45305).

§6.9. Other changes

  • The following packages have been added to the maintained section of the software repository: python-winrm (Bug 45783)
  • The dependency of univention-java has been changed from openjdk-7-jre and icedtea-7-plugin to default-jre and icedtea-plugin (Bug 45959).
  • The list of available PPD printer driver has been updated in univention-printserver. No longer available drivers are marked as deprecated (Bug 45958).
  • OpenSSH has been updated from version 6.7 to 7.4 containing backward incompatible changes: The old SSH v.1 protocol has been removed. Many legacy algorithms have been disabled, as they are considered cryptographically weak nowadays. The Univention Configuration Registry template file for openssh has been updated accordingly: The deprecated Univention Configuration Registry variables sshd/Protocol and sshd/ServerKeyBits have been removed. The privilege separation mode has been changed to the new default sandbox. All other settings have been reviewed and reset to their default value if appropriate (Bug 46033).
  • The univention-runit configuration has been adapted to Debian Stretch (Bug 45861).
  • To prevent systemctl from reporting a wrong status for the services univention-bind, univention-dhcp, univention-directory-notifier and univention-directory-listener, the runsv timeout has been increased to 30 seconds (Bug 46310, Bug 46311, Bug 46312, Bug 46313).
  • The univention-directory-listener is now properly re-started in univention-directory-replication-resync (Bug 46372).
  • The ntp init script has been removed from univention-base-files. Instead the systemd script provided by ntp is being used (Bug 46071).
  • UCS 4.3 adds support for PostgreSQL-9.6 and drops PostgreSQL-9.1. If PostgreSQL-9.1 is installed, it needs to be migrated to the UCS 4.2 default PostgreSQL-9.4 before the update. The required steps for migration are described in Updating from PostgreSQL 9.1 to PostgreSQL 9.4. UCS packages depending on the old version have been updated (Bug 44160).
  • The package univention-bacula has been updates to the new versions of Bacula and PostgreSQL-9.6 from Debian. Support for old version of PostgreSQL has been removed (Bug 46327).
  • GRUB has been updated to a new version. Support for para-virtualized Xen domains has been removed. The SHIM binary has been renamed to follow the upstream naming schema (Bug 46342).
  • The at daemon child processes are no longer terminated during the release upgrade (Bug 46388).
  • The program makepasswd uses /dev/urandom again instead of /dev/random (Bug 46260).
  • The package priority of package di-univention-system-setup has been changed to standard (Bug 46464).
  • The package univention-dhcp was adapted to handle incomplete network configurations missing Univention Configuration Registry variables interfaces/*/network and interfaces/*/broadcast (Bug 46515).
  • The packages pykota and univention-printquota have been adapted to the needs of UCS 4.3 (Bug 46570, Bug 46575).
  • The network installation profiles were updated for UCS 4.3 (Bug 45747).