UCS 4.4 Release Notes

Release notes for the installation and update of Univention Corporate Server (UCS) 4.4-3


Table of Contents

1. Release Highlights
2. Notes about the update
2.1. Recommended update order for environments with more than one UCS server
2.2. UCS installation DVD only available for 64 bit
3. Preparation of update
4. Postprocessing of the update
5. Notes on selected packages
5.1. Collection of usage statistics
5.2. Scope of security support for WebKit, Konqueror and QtWebKit
5.3. Recommended browsers for the access to Univention Management Console
6. Changelog
6.1. General
6.2. Basic system services
6.2.1. Other system services
6.3. Domain services
6.3.1. OpenLDAP
6.3.1.1. Listener/Notifier domain replication
6.4. Univention Management Console
6.4.1. Univention Management Console web interface
6.4.2. Univention Portal
6.4.3. Univention Management Console server
6.4.4. Univention App Center
6.4.5. Univention Directory Manager UMC modules and command line interface
6.4.6. Modules for system settings / setup wizard
6.4.7. Domain join module
6.4.8. Univention Directory Reports
6.4.9. License module
6.4.10. System diagnostic module
6.4.11. Process overview module
6.4.12. Policies
6.4.13. Filesystem quota module
6.4.14. Univention Configuration Registry module
6.4.15. Other modules
6.4.16. Development of modules for Univention Management Console
6.5. Univention base libraries
6.6. Software deployment
6.7. System services
6.7.1. Docker
6.7.2. SAML
6.7.3. Univention self service
6.7.4. Dovecot
6.7.5. Nagios
6.7.6. Apache
6.7.7. SSL
6.7.8. Other services
6.8. Virtualization
6.8.1. UCS Virtual Machine Manager (UVMM)
6.9. Services for Windows
6.9.1. Samba
6.9.2. Univention AD Takeover
6.9.3. Univention S4 Connector
6.10. Other changes

§Chapter 1. Release Highlights

With Univention Corporate Server 4.4-3, the third point release of Univention Corporate Server (UCS) 4.4 is now available. It provides several feature improvements and extensions, new properties as well as various improvements and bugfixes. Here is an overview of the most important changes:

  • Several details of the Univention Management Console have been improved: The size of the RAM is now already checked during the installation. A new document exists for setting up printer drivers, which is directly linked. Searching for IPv4 addresses and the configuration of mail distribution lists has been simplified.

  • The Univention S4 connector has received many small improvements, e.g. when renaming host and DNS entries, a fix for account expiry dates in certain time zones, and for exceptional cases when objects are restored in UCS@school environments.

  • A crash issue in OpenLDAP and a problem when accessing shares with Windows Explorer has been fixed.

  • Most packages have been converted from python-support to dh_python2 in preparation for the switch from Python 2 to Python 3.

  • Various security updates have been integrated into UCS 4.4-3, e.g. Samba, the Linux kernel and Dovecot. A complete list of security and package updates is available in Chapter 6.

§Chapter 2. Notes about the update

During the update some services in the domain may not be available temporarily, that is why the update should occur in a maintenance window. It is recommended to test the update in a separate test environment prior to the actual update. The test environment should be identical to the production environment. Depending on the system performance, network connection and the installed software the update will take between 20 minutes and several hours.

§2.1. Recommended update order for environments with more than one UCS server

In environments with more than one UCS system, the update order of the UCS systems must be borne in mind:

The authoritative version of the LDAP directory service is maintained on the master domain controller and replicated to all the remaining LDAP servers of the UCS domain. As changes to the LDAP schema can occur during release updates, the master domain controller must always be the first system to be updated during a release update.

§2.2. UCS installation DVD only available for 64 bit

Starting with UCS 4.0, installation DVD are only provided for the x86 64 bit architecture (amd64). Existing 32 bit UCS 3 systems can still be updated to UCS 4.0 through the online repository or by using update DVD. The 32 bit architecture will be supported over the entire UCS 4 maintenance period.

§Chapter 3. Preparation of update

It must be checked whether sufficient disk space is available. A standard installation requires a minimum of 10 GB of disk space. The update requires approximately 4 GB additional disk space to download and install the packages, depending on the size of the existing installation.

For the update, a login should be performed on the system's local console as user root, and the update should be initiated there. Alternatively, the update can be conducted using Univention Management Console.

Remote updating via SSH is not recommended as this may result in the update procedure being canceled, e.g., if the network connection is interrupted. In consequence, this can affect the system severely. If updating should occur over a network connection nevertheless, it must be verified that the update continues in case of disconnection from the network. This can be achieved, e.g., using the tools screen and at. These tools are installed on all UCS system roles by default.

Univention provides a script that checks for problems which would prevent the successful update of the system. Prior to the update, this script can be downloaded and executed on the UCS system.

# download
curl -OOs https://updates.software-univention.de/download/univention-update-checks/pre-update-checks-4.4{,.gpg}

# run script
gpgv --keyring /usr/share/keyrings/univention-archive-key-ucs-4x.gpg \
        pre-update-checks-4.4.gpg pre-update-checks-4.4 && bash pre-update-checks-4.4

...

Starting pre-update checks ...

Checking app_appliance ...                        OK
Checking block_update_of_NT_DC ...                OK
Checking cyrus_integration ...                    OK
Checking disk_space ...                           OK
Checking hold_packages ...                        OK
Checking ldap_connection ...                      OK
Checking ldap_schema ...                          OK
...

§Chapter 4. Postprocessing of the update

Following the update, new or updated join scripts need to be executed. This can be done in two ways: Either using the UMC module Domain join or by running the command univention-run-join-scripts as user root.

Subsequently the UCS system needs to be restarted.

§Chapter 5. Notes on selected packages

§5.1. Collection of usage statistics

Anonymous usage statistics on the use of Univention Management Console are collected when using the UCS Core Edition. The modules opened get logged to an instance of the web traffic analysis tool Piwik. This makes it possible for Univention to tailor the development of Univention Management Console better to customer needs and carry out usability improvements.

This logging is only performed when the UCS Core Edition license is used. The license status can be verified via the menu entry License -> License information of the user menu in the upper right corner of Univention Management Console. If UCS Core Edition is listed under License type, this version is in use. When a regular UCS license is used, no usage statistics are collected.

Independent of the license used, the statistics generation can be deactivated by setting the Univention Configuration Registry variable umc/web/piwik to false.

§5.2. Scope of security support for WebKit, Konqueror and QtWebKit

WebKit, Konqueror and QtWebKit are shipped in the maintained branch of the UCS repository, but not covered by security support. WebKit is primarily used for displaying HTML help pages etc. Firefox should be used as web browser.

§5.3. Recommended browsers for the access to Univention Management Console

Univention Management Console uses numerous JavaScript and CSS functions to display the web interface. Cookies need to be permitted in the browser. The following browsers are recommended:

  • Chrome as of version 71

  • Firefox as of version 60

  • Safari and Safari Mobile as of version 12

  • Microsoft Edge as of version 18

As of this release Internet Explorer is not supported by Univention Management Console anymore.

Users running older browsers may experience display or performance issues.

§Chapter 6. Changelog

Listed are the changes since UCS 4.4-2:

§6.1. General

§6.2. Basic system services

§6.2.1. Other system services

  • The package univention-licence now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/ (Bug 49137).
  • The package univention-doc now uses dh_python2 instead of python-support (Bug 49131).

§6.3. Domain services

§6.3.1. OpenLDAP

  • Depending on database memory layout it could happen, that the OpenLDAP server process slapd failed to restart because it incurred a bus error (Bug 49780).

§6.3.1.1. Listener/Notifier domain replication

  • Update of LMDB to version from Debian 10 (Buster), which fixes several internal cursor handling problems (Bug 47587).
  • Remove unused file memcached_univention-directory-listener.conf (Bug 48139).
  • Add missing Univention Configuration Registry header to run script (Bug 50110).
  • Remove legacy code using DB3 database (Bug 50407).
  • Migrate Python code from python-support to dh_python2 (Bug 49146).
  • Explicitly close second database cursor when deleting cache entries (Bug 47587).

§6.4. Univention Management Console

§6.4.1. Univention Management Console web interface

  • Progress bars were jumping up and down when the info text changed and the number of lines were different (Bug 33590).
  • The package univention-directory-manager-modules now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/admin/ (Bug 49147).

§6.4.2. Univention Portal

  • The package univention-server-overview now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49164, Bug 49161).

§6.4.3. Univention Management Console server

  • The UMC for UCS Core Editions shows a dialog that informs about the Univention Summit 2020 (Bug 50530).
  • The development package now uses a file from the translation package univention-ucs-translation-template instead of using its own mechanism for generating translation files (Bug 50341).
  • The LDAP service is not restarted anymore on every change of the attribute univentionService for any computer object in the domain (Bug 47706).
  • The package univention-appcenter now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/ (Bug 49161).

§6.4.4. Univention App Center

  • The package univention-app-appliance now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/app_appliance/ (Bug 49128).
  • Better error message are shown in case the LDAP schema registration fails (Bug 50481).
  • Added version check for global App Center (Bug 50450).
  • The package univention-appcenter now uses dh_python2 instead of python-support (Bug 50425).
  • Use univention-l10n-build to build localization files for univention-appcenter (Bug 50340, Bug 49161).
  • InitialValue of App Settings is now working for settings with a defined scope of outside (Bug 50203).

§6.4.5. Univention Directory Manager UMC modules and command line interface

  • Fix regression from UCS 4.4-3 erratum 349, which could lead to a Python traceback during Univention Directory Manager hook import (Bug 50495).
  • Prevent TypeError during logging of invalid date values in the UDM REST service (Bug 50476).
  • A link to a support article for printer driver distribution is now shown in the UMC printers module (Bug 50376).
  • The package univention-directory-manager-modules now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/admin/ (Bug 49147).
  • Fix regression from UCS 4.4-3 erratum 348, which could lead to a Python traceback during UDM module import, in cases where modules had been installed under the legacy path /usr/share/pyshared, like e.g. the mailquota module (Bug 50493).
  • The gidNumber and sambaPrimaryGroupSID of users/user is now set during the object creation instead of setting it afterwards (Bug 50161).
  • Searching for the IP address property of computer objects now also searches for IPv6 addresses (Bug 49313).
  • The properties allowedEmailUsers and allowedEmailGroups of groups/group and mail/lists have been added to the UDM module mapping (Bug 50239).
  • Some code cleanup in the UDM users/user filter for disabled and locked properties has been done (Bug 50236).
  • The DHCP assignment for computers with multiple MAC addresses has been repaired (Bug 44937).
  • The logging and error handling when removing child objects has been improved (Bug 50288).

§6.4.6. Modules for system settings / setup wizard

  • The package univention-management-console-module-ipchange now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ ^(Bug 49152, Bug 49161).
  • A warning is shown if the minimum RAM requirements to install UCS are not met (Bug 50448).
  • The package univention-system-setup now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49142).

§6.4.7. Domain join module

  • The new tool univention-fetch-certificate is used during join (Bug 45115).
  • The package univention-join now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49149, Bug 49161).
  • Automatically apply the master domain controller settings of the Univention Configuration Registry variables ldap/database/mdb/maxsize and listener/cache/mdb/maxsize on backup domain controller and slave domain controller systems during the join (Bug 50114).

§6.4.8. Univention Directory Reports

  • The package univention-directory-reports now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/directory/ (Bug 49148).

§6.4.9. License module

  • Fixed an error while loading the System Activation Wizard (Bug 50267).

§6.4.10. System diagnostic module

  • A broken test for filesystem permissions has been removed (Bug 50394).
  • The package univention-management-console-module-diagnostic now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49151).

§6.4.11. Process overview module

  • The package univention-management-console-module-top now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49158).

§6.4.12. Policies

  • The package univention-policy now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/lib/ (Bug 49138).

§6.4.13. Filesystem quota module

  • The package univention-quota now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49141).

§6.4.14. Univention Configuration Registry module

  • The package univention-management-console-module-ucr now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49159).

§6.4.15. Other modules

  • The package univention-system-info now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49165).
  • The package ships the directory /usr/share/univention-management-console-module-udm/ again. This is necessary for creation of reports and has been broken in UCS 4.4-3 erratum 346 (Bug 50497).
  • UDM handlers are now able to display help texts in their UMC module (Bug 50376).
  • The package univention-management-console-module-udm now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49160).
  • The package univention-management-console-module-mrtg now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49154, Bug 49161).

§6.4.16. Development of modules for Univention Management Console

  • The package univention-management-console-module-lib now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49153, Bug 49161).

§6.5. Univention base libraries

  • The listener module ldap_extension now stores success or error messages in a new LDAP attribute univentionListenerMessage. These are used in the App center to improve error messages (Bug 50481).
  • The objectClass top is now automatically added to the container cn=dns,$LDAP_BASE, when the LDAP is initially provisioned. Existing systems are not modified (Bug 46649).
  • Added set/get_handler_message to store/get listener messages in the LDAP directory (as settings data object) (Bug 50481).
  • Remove deprecated module univention.lib.umc_connection (Bug 47205).

§6.6. Software deployment

  • The package univention-updater now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/updater/ and /usr/lib/python2.7/dist-packages/univention/management/console/modules/updater/ (Bug 49143).

§6.7. System services

§6.7.1. Docker

  • Added file daemon.json for dockerd parameters (Bug 50295).

§6.7.2. SAML

  • It is now possible to make the SAML Identity Provider accessible under multiple URL sub-paths, each with its own entityID but with the same configuration. This has been added to use the SAML Identity Provider with multiple Azure domains (Bug 50510).
  • The UDM modules saml/idpconfig and saml/serviceprovider have been modernized (Bug 50345).
  • The package univention-saml now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/admin/handlers/ (Bug 49167).
  • Is is now possible to restrict negotiate authentication to certain IP networks via the Univention Configuration Registry variable saml/idp/negotiate/filter-subnets (Bug 49485).

§6.7.3. Univention self service

  • The package univention-self-service now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49163).
  • The LDAP ACLs have been improved to allow UCS@school users to use the self service feature (Bug 50037).

§6.7.4. Dovecot

  • The package univention-mail-dovecot now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/mail/ (Bug 49144).

§6.7.5. Nagios

  • Improve Nagios check for nscd to check for a working nscd by querying its statistics data (Bug 49967).

§6.7.6. Apache

  • A new package univention-apache-vhost has been added. It is installed by default and ships a Univention Configuration Registry template to hold virtual hosts for Apache beyond the default ones. A new tool univention-add-vhost has been added to add (and remove) these virtual hosts (Bug 45115).

§6.7.7. SSL

  • If the service Wildcard Certificate is added to a host, a wildcard certificate for that host is created (*.$fqhn) on the master domain controller. A new tool univention-fetch-certificate has been added to simplify the download of certificates from the master domain controller (Bug 45115).

§6.7.8. Other services

  • Repaired firewall rules regarding docker networks getting broken after a restart of the firewall (Bug 50088).
  • The package univention-management-console-module-services now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/uvmm/ (Bug 49157, Bug 49161).
  • The package univention-management-console-module-reboot now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/uvmm/ (Bug 49156, Bug 49161).

§6.8. Virtualization

§6.8.1. UCS Virtual Machine Manager (UVMM)

  • The package univention-virtual-machine-manager-daemon now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/uvmm/ (Bug 49179).
  • Allow to migrate VMs again after failure (Bug 50092).
  • The package univention-virtual-machine-manager-schema now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/admin/ (Bug 49181).
  • The package novnc from Debian Buster is now used (Bug 35428).
  • The package univention-virtual-machine-manager-node has been prepared for Python 3 (Bug 49180).

§6.9. Services for Windows

§6.9.1. Samba

  • Samba does not recognizing Unix SIDs as valid. This causes Microsoft Windows explorer to crash when opening the security tab on a share or file where such SIDs are present in the ACLs (Bug 49747).

§6.9.2. Univention AD Takeover

  • The package univention-management-console-module-adtakeover now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49150).

§6.9.3. Univention S4 Connector

  • Recreating user and group objects which have been deleted before used to cause rejects in UCS@school (Bug 49792).
  • Time conversion of the attribute accountExpires/userexpiry has been fixed to prevent a loop in the Univention S4 connector which incremented userexpiry on certain timezones (Bug 50202).
  • Renamed DNS records are now correctly removed from Samba/AD when the object in UCS was renamed (Bug 49728).
  • DNS host records without IP addresses are now synchronized to Samba/AD (Bug 49874).
  • The UDM modules container/msgpo, settings/msprintconnectionpolicy and settings/mswmifilter have been modernized (Bug 50342).
  • The use of the function normalise_userAccountControl() has been replaced in mapping.py with a static mapping (Bug 50305).
  • Detection of equal DN's when moving objects has been enhanced (Bug 49976).
  • Error handling for already removed objects has been improved (Bug 49876).
  • Logging of UDM related debug messages has been improved. This can be controlled by the Univention Configuration Registry variable connector/debug/udm/level (Bug 43096).
  • Removal of GPOs in Samba does not cause a reject anymore. When objects are removed where the parent object is already removed the removal now succeeds (Bug 49324).

§6.10. Other changes

  • Add documentation for .univention-l10n format (Bug 50521).
  • univention-l10n-build now runs without any UCS dependency and recognizes UMC .po files (Bug 50341).