Table of Contents
With Univention Corporate Server 4.3-4, the forth point release of Univention Corporate Server (UCS) 4.3 is now available. It provides several feature improvements and extensions, new properties as well as various improvements and bugfixes. Here is an overview of the most important changes:
A new Univention Directory Notifier protocol version has been added.
Directory replication metadata is now additionally stored in the LDAP Database cn=translog.
Support to configure multiple certificates for Server Name Indication (SNI) has been added to the package univention-mail-dovecot.
Various improvements have been implemented for the UCS Virtual Machine Manager (UVMM):
CPU and RAM usage of virtualization hosts is now displayed.
Hyper-V Enlightenment is configured for Windows virtual machines.
RAM overcommitment protection can now be configured with Univention Configuration Registry variable uvmm/overcommit/reserved.
It is now possible to modify the entry of the LDAP base again, for example modify references to policies.
Various security updates have been integrated into UCS 4.3-4, e.g. Apache2, the Linux kernel and Samba4. A complete list is available in Chapter 6.
During the update some services in the domain may not be available temporarily, that is why the update should occur in a maintenance window. It is recommended to test the update in a separate test environment prior to the actual update. The test environment should be identical to the production environment. Depending on the system performance, network connection and the installed software the update will take between 20 minutes and several hours.
In environments with more than one UCS system, the update order of the UCS systems must be borne in mind:
The authoritative version of the LDAP directory service is maintained on the master domain controller and replicated to all the remaining LDAP servers of the UCS domain. As changes to the LDAP schema can occur during release updates, the master domain controller must always be the first system to be updated during a release update.
Starting with UCS 4.0, installation DVD are only provided for the x86 64 bit architecture (amd64). Existing 32 bit UCS 3 systems can still be updated to UCS 4.0 through the online repository or by using update DVD. The 32 bit architecture will be supported over the entire UCS 4 maintenance period.
It must be checked whether sufficient disk space is available. A standard installation requires a minimum of 10 GB of disk space. The update requires approximately 4 GB additional disk space to download and install the packages, depending on the size of the existing installation.
For the update, a login should be performed on the system's local console as user root, and the update should be initiated there.
Alternatively, the update can be conducted using Univention Management Console.
Remote updating via SSH is not recommended as this may result in the update procedure being canceled, e.g., if the network connection is interrupted.
In consequence, this can affect the system severely.
If updating should occur over a network connection nevertheless, it must be verified that the update continues in case of disconnection from the network.
This can be achieved, e.g., using the tools screen and at. These tools are installed on all UCS system roles by default.
Following the update, new or updated join scripts need to be executed.
This can be done in two ways:
Either using the UMC module or by running the command
univention-run-join-scripts as user root.
Subsequently the UCS system needs to be restarted.
Anonymous usage statistics on the use of Univention Management Console are collected when using the UCS Core Edition. The modules opened get logged to an instance of the web traffic analysis tool Piwik. This makes it possible for Univention to tailor the development of Univention Management Console better to customer needs and carry out usability improvements.
This logging is only performed when the UCS Core Edition license is used. The license status can be verified via the menu entry of the user menu in the upper right corner of Univention Management Console. If is listed under , this version is in use. When a regular UCS license is used, no usage statistics are collected.
Independent of the license used, the statistics generation can be deactivated by setting the Univention Configuration Registry variable umc/web/piwik to false.
WebKit, Konqueror and QtWebKit are shipped in the maintained branch of the UCS repository, but not covered by security support. WebKit is primarily used for displaying HTML help pages etc. Firefox should be used as web browser.
Univention Management Console uses numerous JavaScript and CSS functions to display the web interface. Cookies need to be permitted in the browser. The following browsers are recommended:
Chrome as of version 37
Firefox as of version 38
Internet Explorer as of version 11
Safari and Safari Mobile as of version 9
Users running older browsers may experience display or performance issues.
Listed are the changes since UCS 4.3-3:
All security updates issued for UCS 4.3-4 are included:
The following updated packages from Debian 9.6 are included (Bug 48278): wpa, base-files, ca-certificates-java, dnspython, erlang, espeakup, gnupg2, ibus, libdatetime-timezone-perl, libgpod, libssh, openvpn, postfix, postgresql-9.6, postgrey, tzdata, xapian-core, ansible, arc, astroml-addons, c3p0, chkrootkit, chromium, compactheader, coturn, courier, debian-edu-config, debian-installer, debian-installer-netboot-images, debian-security-support, drupal7, egg, flatpak, ganeti-os-noop, glx-alternatives, gnulib, golang-1.7, golang-1.8, graphite-api, grokmirror, icinga2, ikiwiki, isort, jdupes, kmodpy, libapache-mod-jk, libapache2-mod-auth-mellon, libb2, libemail-address-list-perl, libextractor, libu2f-host, linux-igd, lttng-modules, mistral, monkeysign, mosquitto, mpqc, mumble, netatalk, neutron, nvidia-graphics-drivers, nvidia-modprobe, nvidia-persistenced, nvidia-settings, nvidia-xconfig, openni2, parsedatetime, passenger, pdns, pdns-recursor, photocollage, putty, pylint-django, python-acme, python-arpy, python-certbot, python-certbot-apache, python-certbot-nginx, python-hypothesis, python-josepy, pyzo, r-cran-readxl, rssh, rtkit, ruby-loofah, ruby-rack, ruby-sanitize, sl-modem, sogo-connector, spip, ssh-agent-filter, supercollider, sympa, thunderbird, tmpreaper, tryton-server, twig, twitter-bootstrap3, uglifyjs, vm, vulture, waagent, wicd, wordpress, wvstreams, xen, xkeycaps, xmltooling, yosys, z3
The following packages have been moved to the maintained repository of UCS: fail2ban (Bug 47566), libmaxminddb (Bug 48409)
univention-translog check --fix command to check (and fix) inconsistency between the files /var/lib/univention-ldap/notify/transaction, /var/lib/univention-ldap/notify/transaction.index, /var/lib/univention-ldap/listener/listener, and /var/lib/univention-ldap/last_id (Bug 49202).
/var/lib/univention-ldap/notify/transaction and the cn=translog database in OpenLDAP.
A failed write to the later can make UDN abort, in which case UDN is restarted automatically and writes the pending transactions to said file again.
This leads to inconsistency.
The order has been swapped to prevent this issue from happening again.
The transaction file might require manual corrections if UDN fails to start up properly.
Details of this procedure will be provided by a future update (Bug 49199).
univention-replicate-many can be used to re-replicate multiple objects at once (Bug 41262).
umc/web/sso/enabled (Bug 48985).
pam_cracklib were evaluated again when changing the password via Univention Management Console.
The old behavior has been restored later on.
Therefore password changes do not require strong passwords anymore if no password policy is defined in the domain (Bug 48684, Bug 49039).
univention-run-diagnostic-checks which can be used to execute the diagnostic checks (Bug 47650).
cn=translog setup, which reset the LDAP index.
If an UCS-4.3 system was updated to Erratum 426 before this erratum was made available, the list of indexed LDAP attributes was reset to the default on master and backup systems.
This may lead to slow LDAP searches.
If other attributes were added manually to the Univention Configuration Registry variables ldap/index/eq, ldap/index/sub, ldap/index/pres, they must be restored manually.
The old values might be recovered from the log file /var/log/univention/config-registry.replog.
After a manual change of these Univention Configuration Registry variables, the LDAP server index need to be updated by stopping the slapd service, then running the script /usr/share/univention-ldap/ldap_setup_index and starting the slapd service again (Bug 48970).
cn=monitor backend for statistical information.
To activate this, set the Univention Configuration Registry variable ldap/monitor=true and restart the LDAP server service (slapd) (Bug 41213).
cn=translog database for transaction log (Bug 48427).
ldap_extension is performed on backup domain controller and slave domain controller systems to correct possible inconsistencies in LDAP ACLs (Bug 48530).
cn=config backend, accessible via LDAPI only (Bug 43515).
die() function to ldap.sh (Bug 47424).
cron mails for a successful ldap-backup cron job (Bug 48014).
univention-repository-addpackage, univention-repository-delpackage and univention-repository-merge are deprecated and will be removed with UCS-4.4 (Bug 29505).
dists/ are now also mirrored.
This is required for the PXE network installer (Bug 46600).
update/debug/level for changing the debug level of the UCS updater (Bug 47913).
postmirror.sh file is no longer displayed (Bug 27761).
VirtualHost configuration can now be extended by placing .conf files in the directory /etc/apache2/sso-vhost.conf.d/ (Bug 48348).
mail/dovecot/ssl/sni/$fqdn/certificate=$path_to_certificate and mail/dovecot/ssl/sni/$fqdn/key=$path_to_certificate_key (Bug 49064).
/var/spool/dovecot/private/ by unsuccessful login attempts of users without a primary mail address (Bug 48628).
/etc/cups/cupsd.local.conf is applied again.
Since Erratum 149 the CUPS Include directive has been removed.
Changes in the /etc/cups/cupsd.local.conf configuration require a ucr commit /etc/cups/cupsd.conf now (Bug 49197).
None or smb (raw) printer model (Bug 47843).
/usr/share/cups/model is a link to /usr/share/ppd (Bug 47435).
uvmm/overcommit/reserved (Bug 48098).