UCS 4.3 Release Notes

Release Notes für die Inbetriebnahme und Aktualisierung von Univention Corporate Server (UCS) 4.3-3

Inhaltsverzeichnis

1. Release-Highlights
2. Hinweise zum Update
2.1. Empfohlene Update-Reihenfolge
2.2. UCS-Installations-DVDs nur noch als 64-Bit-Variante
3. Vorbereitung des Updates
4. Nachbereitung des Updates
5. Hinweise zum Einsatz einzelner Pakete
5.1. Erfassung von Nutzungsstatistiken
5.2. Umfang des Sicherheits-Supports von WebKit, Konqueror und QtWebKit
5.3. Empfohlene Browser für den Zugriff auf Univention Management Console
6. Changelog
6.1. General
6.2. Univention Installer
6.3. Basic system services
6.3.1. Univention Configuration Registry
6.3.1.1. Changes to templates and modules
6.4. Domain services
6.4.1. OpenLDAP
6.4.1.1. Listener/Notifier domain replication
6.5. Univention Management Console
6.5.1. Univention Management Console web interface
6.5.2. Univention Portal
6.5.3. Univention Management Console server
6.5.4. Univention App Center
6.5.5. Univention Directory Manager UMC modules and command line interface
6.5.6. Modules for system settings / setup wizard
6.5.7. Domain join module
6.5.8. System diagnostic module
6.5.9. Policies
6.5.10. Filesystem quota module
6.5.11. Other modules
6.6. Univention base libraries
6.7. Software deployment
6.8. System services
6.8.1. PostgreSQL
6.8.2. Docker
6.8.3. SAML
6.8.4. Univention self service
6.8.5. Mail services
6.8.6. Dovecot
6.8.7. Printing services
6.8.8. Nagios
6.8.9. RADIUS
6.8.10. Proxy services
6.8.11. SSL
6.9. Virtualization
6.9.1. UCS Virtual Machine Manager (UVMM)
6.10. Services for Windows
6.10.1. Samba
6.10.2. Univention S4 Connector
6.10.3. Univention Active Directory Connection
6.11. Other changes

§Kapitel 1. Release-Highlights

Mit Univention Corporate Server 4.3-3 steht das dritte Point-Release für Univention Corporate Server (UCS) 4.3 zur Verfügung. Es umfasst Funktionserweiterungen und Verbesserungen, neue Eigenschaften sowie diverse Detailverbesserungen und Fehlerkorrekturen. Die wichtigsten Änderungen im Überblick:

  • Die Konfigurationsmöglichkeiten für das UCS Portal wurden erweitert, um es besser an eigene Bedürfnisse anzupassen. Es können jetzt eigene Kategorien für Kacheln definiert werden. Zudem gibt es die Möglichkeit, statische Links zu definieren, um beispielweise ein Impressum zu verlinken.

  • Die neue UCS Dashboard App ermöglicht Administratoren den Zustand der Domäne oder einzelner Server schnell und einfach auf unterschiedlichen Dashboards abzulesen.

  • Neben kleineren Fehlerbehebungen in Univention Management Console wurde insbesondere das Scrolling an vielen Stellen verbessert.

  • Die Einführung einer neuen vereinfachten Python API verringert für Entwickler den Entwicklungsaufwand um auf das UCS Identity Management zuzugreifen.

  • Diverse Security Updates wurden in UCS 4.3-3 integriert, bspw. für den Linux Kernel, Samba und Apache2. UCS 4.3-3 basiert auf dem im November veröffentlichten Debian Release 9.6. Eine vollständige Liste ist in Kapitel 6 zu finden.

§Kapitel 2. Hinweise zum Update

Während der Aktualisierung kann es zu temporären Ausfällen von Diensten innerhalb der Domäne kommen. Aus diesem Grund sollte das Update innerhalb eines Wartungsfensters erfolgen. Grundsätzlich wird empfohlen, das Update zunächst in einer Testumgebung einzuspielen und zu testen. Die Testumgebung sollte dabei identisch zur Produktivumgebung sein. Je nach Systemgeschwindigkeit, Netzwerkanbindung und installierter Software kann das Update zwischen 20 Minuten und mehreren Stunden dauern.

§2.1. Empfohlene Update-Reihenfolge

In Umgebungen mit mehr als einem UCS-System muss die Update-Reihenfolge der UCS-Systeme beachtet werden:

Auf dem Domänencontroller Master wird die maßgebliche (authoritative) Version des LDAP-Verzeichnisdienstes vorgehalten, die an alle übrigen LDAP-Server der UCS-Domäne repliziert wird. Da bei Release-Updates Veränderungen an den LDAP-Schemata auftreten können, muss der Domänencontroller Master bei einem Release-Update immer als erstes System aktualisiert werden.

§2.2. UCS-Installations-DVDs nur noch als 64-Bit-Variante

UCS-Installations-DVDs werden ab UCS 4 nur noch für 64-Bit-Architekturen bereitgestellt. Vorhandene 32-Bit UCS 3 Systeme können weiterhin über das Online Repository oder über Update DVDs auf UCS 4 aktualisiert werden. Die 32-Bit-Architektur wird für die gesamte UCS 4 Maintenance noch unterstützt.

§Kapitel 3. Vorbereitung des Updates

Es sollte geprüft werden, ob ausreichend Festplattenplatz verfügbar ist. Eine Standard-Installation benötigt min. 10 GB Speicherplatz. Das Update benötigt je nach Umfang der vorhanden Installation ungefähr 4 GB zusätzlichen Speicherplatz zum Herunterladen und Installieren der Pakete.

Für das Update sollte eine Anmeldung auf der lokalen Konsole des Systems mit dem Benutzer root durchgeführt und das Update dort gestartet werden. Alternativ kann das Update über Univention Management Console durchgeführt werden.

Eine Remote-Aktualisierung über SSH wird nicht empfohlen, da dies beispielsweise bei Unterbrechung der Netzverbindung zum Abbruch des Update-Vorgangs und zu einer Beeinträchtigung des Systems führen kann. Sollte dennoch eine Aktualisierung über eine Netzverbindung durchgeführt werden, ist sicherzustellen, dass das Update bei Unterbrechung der Netzverbindung trotzdem weiterläuft. Hierfür können beispielsweise die Tools screen oder at eingesetzt werden, die auf allen UCS Systemrollen installiert sind.

§Kapitel 4. Nachbereitung des Updates

Nach dem Update müssen die neuen oder aktualisierten Join-Skripte ausgeführt werden. Dies kann auf zwei Wegen erfolgen: Entweder über das UMC-Modul Domänenbeitritt oder durch Aufruf des Befehls univention-run-join-scripts als Benutzer root.

Anschließend muss das UCS-System neu gestartet werden.

§Kapitel 5. Hinweise zum Einsatz einzelner Pakete

§5.1. Erfassung von Nutzungsstatistiken

Bei Verwendung der UCS Core Edition werden anonyme Nutzungsstatistiken zur Verwendung von Univention Management Console erzeugt. Die aufgerufenen Module werden dabei von einer Instanz des Web-Traffic-Analyse-Tools Piwik protokolliert. Dies ermöglicht es Univention die Entwicklung von Univention Management Console besser auf das Kundeninteresse zuzuschneiden und Usability-Verbesserungen vorzunehmen.

Diese Protokollierung erfolgt nur bei Verwendung der UCS Core Edition. Der Lizenzstatus kann überprüft werden durch den Eintrag Lizenz -> Lizenzinformation des Benutzermenüs in der rechten, oberen Ecke von Univention Management Console. Steht hier unter Lizenztyp der Eintrag UCS Core Edition wird eine solche Edition verwendet. Bei Einsatz einer regulären UCS-Lizenz erfolgt keine Teilnahme an der Nutzungsstatistik.

Die Protokollierung kann unabhängig von der verwendeten Lizenz durch Setzen der Univention Configuration Registry-Variable umc/web/piwik auf false deaktiviert werden.

§5.2. Umfang des Sicherheits-Supports von WebKit, Konqueror und QtWebKit

WebKit, Konqueror und QtWebKit werden in UCS im maintained-Zweig des Repositorys mitgeliefert, aber nicht durch Sicherheits-Updates unterstützt. WebKit wird vor allem für die Darstellung von HTML-Hilfeseiten u.ä. verwendet. Als Web-Browser sollte Firefox eingesetzt werden.

§5.3. Empfohlene Browser für den Zugriff auf Univention Management Console

Univention Management Console verwendet für die Darstellung der Web-Oberfläche zahlreiche JavaScript- und CSS-Funktionen. Cookies müssen im Browser zugelassen sein. Die folgenden Browser werden empfohlen:

  • Chrome ab Version 37

  • Firefox ab Version 38

  • Internet Explorer ab Version 11

  • Safari und Safari Mobile ab Version 9

Mit älteren Browsern können Darstellungs- oder Performanceprobleme auftreten.

§Kapitel 6. Changelog

Die Changelogs mit den detaillierten Änderungsinformationen werden nur in Englisch gepflegt. Aufgeführt sind die Änderungen seit UCS 4.3-2:

§6.1. General

§6.2. Univention Installer

  • The UCS DVD now contains the package netcat-openbsd. It is required for VNC access to virtual machines (Bug 48015).
  • If UCS is installed from an USB stick, grub-install shows a screen to select the boot device. That list no longer includes the USB stick itself (Bug 47925).

§6.3. Basic system services

§6.3.1. Univention Configuration Registry

  • Univention Configuration Registry modules cannot accidentally get registered multiple times anymore (Bug 35239).

§6.3.1.1. Changes to templates and modules

  • Ensure that the address associated with the network interface specified via the Univention Configuration Registry variable interfaces/primary is the first entry in /etc/hosts (Bug 30397).
  • Ensure that the directory /var/univention-backup/ exists in univention-config-registry-backup (Bug 47336).

§6.4. Domain services

§6.4.1. OpenLDAP

§6.4.1.1. Listener/Notifier domain replication

  • The Univention Directory Listener opens two connections: a persistent connection to a Univention Directory Notifier and an on-demand connection to an LDAP server. In some rare situations two different hosts were contacted for those connections, which could lead to inconsistencies in LDAP replication (Bug 48030).
  • Fix terminal detection code in univention-directory-listener-ctrl (Bug 47870).
  • Log a message when a listener module using the new API was deactivated (Bug 47871).
  • Fixed a crash when the Univention Configuration Registry variables server/role and ldap/master are not set (Bug 47837).
  • An alternative mechanism to initialize the Univention Directory Listener in large environments was added (Bug 47783).

§6.5. Univention Management Console

§6.5.1. Univention Management Console web interface

  • A widget for limited text input has been moved to the common library (Bug 48106).
  • Long item names in the tree widget no longer overlap underlying items (Bug 45323).
  • The version of the dojo framework has been upgraded (Bug 47997).
  • The scrolling in the UCS Virtual Machine Manager module has been improved (Bug 36624).
  • The scrolling in the LDAP directory module has been improved (Bug 45598).
  • It is now possible to define custom categories for the portal (Bug 47243).
  • An issue with the drop-down menu for the search value in the advanced search of UDM modules being unusable has been resolved (Bug 44471).

§6.5.2. Univention Portal

  • The ordering of the default categories in the Portal unintentionally changed with a previous update. This has been reverted (Bug 47872).
  • Fix the broken text of the portal title and name (Bug 47877).
  • Portal entries not shown after update to latest portal version (Bug 47870).
  • Portal entries were not shown after the update to erratum 250 (Bug 47864).
  • The visibility of a portal entry object can now be restricted to multiple groups instead of just one (Bug 46927).
  • It is now possible to define custom categories for the portal (Bug 47243).
  • Allow to customize portal with static pages (Bug 43442).

§6.5.3. Univention Management Console server

  • Fix SAML metadata creation for external certificate authorities like Let's Encrypt (Bug 47700).
  • The scrolling in the UCS Virtual Machine Manager module has been improved (Bug 36624).
  • The scrolling in the LDAP directory module has been improved (Bug 45598).
  • Fix regression in traceback handling (Bug 47857).

§6.5.4. Univention App Center

  • Improved check for database existence when installing an app which uses a database (Bug 42690).
  • Checkboxes in the App Settings were marked as required in the HTML causing problems when submitting the form (Bug 47824).
  • The App Center now supports Apps that require multiple containers to work by using docker-compose (Bug 43612).
  • In some cases the App Center removed installed listener modules (Bug 48104).
  • Never prompt in container commands during the app installation (Bug 47763).
  • Installation routines now ask for valid credentials before actually doing anything. Prior to this change, the user may have been prompted for credentials in the middle of the installation process. Invalid credentials at this point may have led to errors (Bug 47619).
  • Proxy settings in containers are updated before an app upgrade (Bug 47439).
  • When an app is opened in the App Center, the page now scrolls to the top and when the App detail page is closed, the previous scroll position is restored (Bug 39667).

§6.5.5. Univention Directory Manager UMC modules and command line interface

  • System accounts are not counted if the license allows unlimited users (Bug 48145).
  • Keep the choices for the modules in extended attributes updated (Bug 30387).
  • Added a new hook base class AttributeHook. This can be used to implement a mapping between LDAP and UDM for extended attributes (Bug 43129).
  • The username admin is now allowed (Bug 38092).
  • The UDM module settings/data was added. It can be used to store arbitrary data in LDAP (Bug 47944).
  • A new API has been added that aims to provide a much easier handles for UDM calls (Bug 47316).
  • The ordering of the default categories in the Portal unintentionally changed with a previous update. This has been reverted (Bug 47872).
  • Ensure update of syntax class mailinglist_name in running Python processes (Bug 48020).
  • Revert reloading syntax.py (Bug 48026).
  • Searching for some UDM properties led to a traceback (Bug 47910).
  • Some error messages are more explicit (Bug 47861).
  • Fix a traceback during portal assignment at computer objects when a settings/portal object is created (Bug 47818).
  • The search filter generated for boolean and multi-value properties of UDM objects was not correct (Bug 40672).
  • The visibility of a portal entry object can now be restricted to multiple groups instead of just one (Bug 46927).
  • For performance reasons, UDM stores the last used value of uidNumber and gidNumber in an LDAP object in the univentionLastUsedValue attribute. Usually these two values are monotonously increasing with automatic assignment. When manually specifying the uidNumber/gidNumber when creating an object, however, this value could jump back to a lower value and previously used and now free values could be reused if necessary. This behavior has now been disabled. univentionLastUsedValue is now monotonously increasing (Bug 41109).
  • User Templates now have access to the alphanum option (Bug 47580).
  • It is now possible to define custom categories for the portal (Bug 47243).
  • Allow to customize portal with an about page (Bug 43442).
  • Searching for some UDM properties led to a traceback (Bug 47910).

§6.5.6. Modules for system settings / setup wizard

  • The error messages for the join into an Active Directory domain have been improved (Bug 42430).
  • A regression introduced while fixing Bug 42022 could cause an appliance setup to fail due to missing software components (Bug 47767).
  • When setting up an UCS appliance to join into an existing UCS domain, the installation could fail due to a failure to reconfigure the network interfaces (Bug 47767).
  • Adapt Univention System Setup to work with Firefox 60 (Bug 47808).

§6.5.7. Domain join module

  • Only try to download the host certificate for 10 minutes when joining a new system. Otherwise, mark the join as failed (Bug 30005).
  • Fixed join failing when two MAC addresses are set on the computer object. Also, joining a host with multiple network interfaces now attaches them all to the computer object (Bug 47338).

§6.5.8. System diagnostic module

  • The ACL check for the Samba/AD SYSVOL files has been improved to show the name of missing files and directories (Bug 47583).
  • A new diagnostic plugin has been added that scans through LDAP and finds objects that lack a univentionObjectType although they should have one. The plugin also allows to migrate those objects. Having a univentionObjectType allows for other services to use a convenient LDAP filter (Bug 47844).
  • Improved logging of diagnostic module actions and the diagnostic checks are now executed in lexical order (Bug 47649).

§6.5.9. Policies

  • Log LDAP connections at log level PROCESS instead of INFO (Bug 48030).

§6.5.10. Filesystem quota module

  • Setting a user quota through a policy now works with journaled (usrjquota) quota as well (Bug 47764).

§6.5.11. Other modules

  • A widget for limited text input has been moved to the common library (Bug 48106).
  • The Univention Directory Manager module flavors are requiring a minimal set of allowed UMC commands now to be visible in the UMC (Bug 47880).
  • A regression in the users/self module regarding saving unset properties with default values has been addressed (Bug 48047).
  • The scrolling in the UCS Virtual Machine Manager module has been improved (Bug 36624).
  • The scrolling in the LDAP directory module has been improved (Bug 45598).
  • The search filter generated for boolean and multi-value properties of UDM objects was not correct (Bug 40672).
  • User Templates now have access to the alphanum option (Bug 47580).
  • It is now possible to define custom categories for the portal (Bug 47243).
  • The page now scrolls to the top when opening the detail page of an UDM object (Bug 39667).

§6.6. Univention base libraries

  • The function umc_init does not assume to find the LDAP group objects cn=Domain Admins and cn=Domain Users as direct children of the cn=groups container anymore. Instead it searches for them (or their localized equivalents, like Domänen-Admins) (Bug 38057).
  • Check output from slapschema during registration of new schemas for errors (Bug 45571).
  • The error messages for the join into an Active Directory domain have been improved (Bug 42430).
  • The UDM module settings/data was added. It can be used to store arbitrary data in LDAP (Bug 47944).
  • False warning message during App installation were removed (Bug 47931).
  • LDAP ACLs for the portal category module have been fixed (Bug 48091).
  • A spelling error in the English description for Univention Configuration Registry variable ldap/debug/level has been fixed (Bug 48102).
  • Fix automatic renewal of Diffie-Hellman parameters for forward secrecy (Bug 47974).
  • Adjust description of Univention Configuration Registry variable ldap/database/mdb/envflags (Bug 47869).
  • It is now possible to define custom categories for the portal (Bug 47243).
  • Allow to customize portal with static pages (Bug 43442).

§6.7. Software deployment

  • In case a Debian package update fails due to unmet dependencies univention-updater now logs a more useful error message (Bug 34444).

§6.8. System services

§6.8.1. PostgreSQL

  • The rule for the PostgreSQL superuser has been moved to the beginning of pg_hba.conf to always grant access to that internal user. This is required for automatic maintenance and similar tasks (Bug 31081).
  • The new Univention Configuration Registry variable postgres9/pg_hba/config/* allows for additional configuration options in the file pg_hba.conf (Bug 47276).

§6.8.2. Docker

  • ifconfig was missing in the UCS container. Also fixed parsing of the tool's output (Bug 46665).

§6.8.3. SAML

  • The Univention Directory Manager module flavors are requiring a minimal set of allowed UMC commands now to be visible in the UMC (Bug 47880).
  • Enable stunnel to run on systems without univention-saml installed, like member server and slave domain controller servers. The univention-saml package was updated to create the required directories (Bug 47250).

§6.8.4. Univention self service

  • The join script now always updates the local database password (Bug 45531).

§6.8.5. Mail services

  • Remove ClamAV from AMaViS configuration if clamav-daemon is disabled via Univention Configuration Registry variable clamav/daemon/autostart=no. Without this change Postfix is unable to process incoming mails due to a non-working AMaViS (Bug 39372).

§6.8.6. Dovecot

  • When creating users, an SSL error occurred when uploading the initial Sieve script if the Dovecot server used an external SSL certificate from Let's Encrypt, for example. The new Univention Configuration Registry variable mail/dovecot/sieve/client/server can now be used to specify an external FQDN for the Sieve script upload that matches the external SSL certificate (Bug 41018).

§6.8.7. Printing services

  • Fix a traceback when querying for printer users (Bug 44434).
  • The printer restrictions are reloaded after changes are made (Bug 43227).

§6.8.8. Nagios

  • The Nagios RAID check now uses the plugin mdstat (Bug 47319).

§6.8.9. RADIUS

  • From now on univention-radius adds a section realm in proxy.conf to allow RADIUS authentication with DOMAIN\USERNAME. The original proxy.conf is diverted to proxy.conf.debian and is included into the new proxy.conf (Bug 42535).
  • A user's description attribute is now no longer modified if the module ldap has been activated manually (Bug 48105).

§6.8.10. Proxy services

  • Squid is now compiled with support for OpenSSL again. This feature was lost during the update to UCS 4.3-0 because Squid 3.5 requires an additional compile time option for this (Bug 47809).

§6.8.11. SSL

  • The cron job to revoke expired certificates now works properly again (Bug 47896).
  • SSL host certificates are now also valid for DNS alias records (Bug 44469).
  • The command univention-certificate renew does not revoke the old certificates anymore, so that they are still valid until they expire. Additionally, certificates can now get addressed by their serial numbers using the option -id (Bug 41013).

§6.9. Virtualization

§6.9.1. UCS Virtual Machine Manager (UVMM)

  • Show a warning if the entered VNC password for a virtual machine exceeds a certain length (Bug 48106).
  • Report IO errors in UMC frontend (Bug 22695).
  • Drop corrupt cache files on errors (Bug 35761).
  • Fix assignment of target device name for newly added disks (Bug 47956).
  • Migration of virtual machines between incompatible CPUs can be prevented by setting the new Univention Configuration Registry variable uvmm/vm/cpu/host-model to either missing or always: This modifies the XML description to include a description for the CPU of the host system for running virtual machines. If a CPU description is present, UVMM will check the target host for compatibility. The migration is aborted if the target host's CPU is not compatible. Virtual machines must be restarted to activate pending changes. UVMM monitors running virtual machines for reboot events and restarts them automatically (Bug 21386).

§6.10. Services for Windows

§6.10.1. Samba

  • Always set map acl inherit = yes for samba shares if NT ACLs and inherit ACLs are activated (Bug 47850).
  • Ignore netlogon_creds_cli.tdb in univention-samba4-backup (Bug 46468).
  • Changing the primary group of a user triggered an inconsistency in the DN SID component of the member attribute. In special situations samba-tool dbcheck was unable to fix this automatically (Bug 48054).
  • Continue samba-tool dbcheck --fix even if a modification failed (Bug 48040).
  • When joining a new Samba/AD DC, Samba replicates all LDAP partitions independently. Depending on timing the replication of the linked attribute serverReference could fail, if CN=Configuration gets replicated before the main domain partition. As a result DRS replication could fail (Bug 47441).

§6.10.2. Univention S4 Connector

  • When performing an AD-Takeover out of an ad/member setup, the S4-Connector reported tracebacks due to missing NT password hashes in OpenLDAP (Bug 35540).
  • Fix sync_to_ucs reject for DNS Start of Authority (SOA) records with trailing dot missing in the Name Server (NS) resource record (Bug 44104).
  • An indentation bug in the mapping file of the S4-Connector has been fixed which triggered an error in cases where Univention Configuration Registry variable connector/s4/mapping/dns/ignorelist was unset or empty (Bug 44711).
  • The group membership sync now correctly identifies ucs_module_others if defined in the mapping (Bug 47779).
  • Renaming a container (only difference in upper and lower case) has been fixed (Bug 47374).
  • When password change on next login had been activated for a user the S4-Connector removed shadowMax and krb5PasswordEnd and reset shadowLastChange to 0 when synchronizing changes back from Samba/AD to UDM/OpenLDAP. In an UCS@school specific UMC module this caused a display issue, where the next required password change was shown as never (Bug 47508, Bug 47595).
  • The S4-Connector no longer updates the obsolete attribute sambaPwdMustChange (Bug 45282).

§6.10.3. Univention Active Directory Connection

  • The Connector now updates the AD attribute userPrincipalName if the UCS username is changed. This is enabled only for new installations. For old systems unset Univention Configuration Registry variable connector/ad/mapping/sync/userPrincipalName and restart the AD-Connector to sync username to userPrincipalName on subsequent object modifications (Bug 48153).
  • univention-adsearch now accepts space separated attribute list as parameter (Bug 43189).
  • Non-printable attributes in univention-adsearch are printed base64 encoded (Bug 48082).
  • The special cn=Subschema object caused AD-Connector rejects (Bug 47396).
  • The synchronization of the attribute proxyAddress may fail if is empty (Bug 46751).
  • Fix AD to UCS password hash synchronization in cases where a custom Domain Admin account is configured for the AD connection (Bug 47069).
  • The error messages for the join into an Active Directory domain have been improved (Bug 42430).
  • Fix Kerberos authentication error during AD-Connector restart in AD/member mode in case of changed system time (Bug 48227).
  • The synchronization of password hashes from AD to UCS has been fixed on systems that have Univention Configuration Registry variable connector/ldap/server set to a non-master server with read-only OpenLDAP (Bug 44024).
  • The package univention-ad-connector-exchange did reset specific Univention Configuration Registry variable values to their default during the update. This has been adjusted to keep customer adjusted values untouched (Bug 47856).
  • The tool univention-adsearch now also uses the file containing the full certificate chain instead of only the exported AD certificate alone (Bug 47858).
  • Support SASL/GSSAPI in AD Connection setup scripts (to support integrity checking during binds) (Bug 47901).
  • A traceback during the add of users in AD with telephone attributes has been fixed (Bug 47209).

§6.11. Other changes

  • Adapt to changes in univention-directory-manager-modules (Bug 47861).
  • The machine account password is changed by default every 21 days. That check is by default performed nightly a 01:00 by a cron job. That point of time can now be configured through the new Univention Configuration Registry variable server/password/cron (Bug 47781).