UCS 4.4 Release Notes

Release notes for the installation and update of Univention Corporate Server (UCS) 4.4-4


Table of Contents

1. Release Highlights
2. Notes about the update
2.1. Recommended update order for environments with more than one UCS server
2.2. UCS installation DVD only available for 64 bit
3. Preparation of update
4. Postprocessing of the update
5. Notes on selected packages
5.1. Collection of usage statistics
5.2. Scope of security support for WebKit, Konqueror and QtWebKit
5.3. Recommended browsers for the access to Univention Management Console
6. Changelog
6.1. General
6.2. Basic system services
6.2.1. Other system services
6.3. Domain services
6.3.1. OpenLDAP
6.3.1.1. Listener/Notifier domain replication
6.4. Univention Management Console
6.4.1. Univention Management Console web interface
6.4.2. Univention Management Console server
6.4.3. Univention App Center
6.4.4. Univention Directory Manager UMC modules and command line interface
6.4.5. Modules for system settings / setup wizard
6.4.6. Domain join module
6.4.7. License module
6.4.8. System diagnostic module
6.4.9. Other modules
6.5. Univention base libraries
6.6. Software deployment
6.6.1. Software monitor
6.7. System services
6.7.1. SAML
6.7.2. Univention self service
6.7.3. Mail services
6.7.4. Postfix
6.7.5. Printing services
6.7.6. Apache
6.7.7. RADIUS
6.7.8. Kerberos
6.7.9. SSL
6.7.10. Celery services
6.7.11. DHCP server
6.7.12. PAM / Local group cache
6.8. Virtualization
6.8.1. UCS Virtual Machine Manager (UVMM)
6.8.2. Operate UCS as virtual machine
6.9. Services for Windows
6.9.1. Univention S4 Connector
6.9.2. Univention Active Directory Connection

§Chapter 1. Release Highlights

With Univention Corporate Server 4.4-4, the fourth point release of Univention Corporate Server (UCS) 4.4 is now available. It provides several feature improvements and extensions, new properties as well as various improvements and bugfixes. Here is an overview of the most important changes:

  • UCS can now log when the last authentication on the LDAP server took place, for example when users logged on using the SAML identity provider. A use case could be the detection of accounts that are no longer in use.

  • The AD Connector can synchronize Kerberos hashes from AD and thus work without NTLM hashes.

  • The AD Connector now officially supports Windows Server 2019. The synchronization of changes to large groups has been accelerated by transferring only changes (new / removed members) and not always the complete list of current group members. In the context of group synchronization a memory leak has also been fixed.

  • User guidance has been improved in the App Center: The number of steps required for installing apps is now displayed, the different message types appear in a clearer, uniform look and feel and have been partially combined onto a single page.

  • The SAML login to the portal and apps has more configuration options, including the various links (How to log in, Login without SSO) can be customized. A new feature is a configurable link to the Forgot password function of the Self Service.

  • Various security updates have been integrated into UCS 4.4-4, e.g. Samba, the Linux kernel and PHP. A complete list of security and package updates is available in Chapter 6.

§Chapter 2. Notes about the update

During the update some services in the domain may not be available temporarily, that is why the update should occur in a maintenance window. It is recommended to test the update in a separate test environment prior to the actual update. The test environment should be identical to the production environment. Depending on the system performance, network connection and the installed software the update will take between 20 minutes and several hours.

§2.1. Recommended update order for environments with more than one UCS server

In environments with more than one UCS system, the update order of the UCS systems must be borne in mind:

The authoritative version of the LDAP directory service is maintained on the master domain controller and replicated to all the remaining LDAP servers of the UCS domain. As changes to the LDAP schema can occur during release updates, the master domain controller must always be the first system to be updated during a release update.

§2.2. UCS installation DVD only available for 64 bit

Starting with UCS 4.0, installation DVD are only provided for the x86 64 bit architecture (amd64). Existing 32 bit UCS 3 systems can still be updated to UCS 4.0 through the online repository or by using update DVD. The 32 bit architecture will be supported over the entire UCS 4 maintenance period.

§Chapter 3. Preparation of update

It must be checked whether sufficient disk space is available. A standard installation requires a minimum of 10 GB of disk space. The update requires approximately 4 GB additional disk space to download and install the packages, depending on the size of the existing installation.

For the update, a login should be performed on the system's local console as user root, and the update should be initiated there. Alternatively, the update can be conducted using Univention Management Console.

Remote updating via SSH is not recommended as this may result in the update procedure being canceled, e.g., if the network connection is interrupted. In consequence, this can affect the system severely. If updating should occur over a network connection nevertheless, it must be verified that the update continues in case of disconnection from the network. This can be achieved, e.g., using the tools screen and at. These tools are installed on all UCS system roles by default.

Univention provides a script that checks for problems which would prevent the successful update of the system. Prior to the update, this script can be downloaded and executed on the UCS system.

# download
curl -OOs https://updates.software-univention.de/download/univention-update-checks/pre-update-checks-4.4{,.gpg}

# run script
gpgv --keyring /usr/share/keyrings/univention-archive-key-ucs-4x.gpg \
        pre-update-checks-4.4.gpg pre-update-checks-4.4 && bash pre-update-checks-4.4

...

Starting pre-update checks ...

Checking app_appliance ...                        OK
Checking block_update_of_NT_DC ...                OK
Checking cyrus_integration ...                    OK
Checking disk_space ...                           OK
Checking hold_packages ...                        OK
Checking ldap_connection ...                      OK
Checking ldap_schema ...                          OK
...

§Chapter 4. Postprocessing of the update

Following the update, new or updated join scripts need to be executed. This can be done in two ways: Either using the UMC module Domain join or by running the command univention-run-join-scripts as user root.

Subsequently the UCS system needs to be restarted.

§Chapter 5. Notes on selected packages

§5.1. Collection of usage statistics

Anonymous usage statistics on the use of Univention Management Console are collected when using the UCS Core Edition. The modules opened get logged to an instance of the web traffic analysis tool Piwik. This makes it possible for Univention to tailor the development of Univention Management Console better to customer needs and carry out usability improvements.

This logging is only performed when the UCS Core Edition license is used. The license status can be verified via the menu entry License -> License information of the user menu in the upper right corner of Univention Management Console. If UCS Core Edition is listed under License type, this version is in use. When a regular UCS license is used, no usage statistics are collected.

Independent of the license used, the statistics generation can be deactivated by setting the Univention Configuration Registry variable umc/web/piwik to false.

§5.2. Scope of security support for WebKit, Konqueror and QtWebKit

WebKit, Konqueror and QtWebKit are shipped in the maintained branch of the UCS repository, but not covered by security support. WebKit is primarily used for displaying HTML help pages etc. Firefox should be used as web browser.

§5.3. Recommended browsers for the access to Univention Management Console

Univention Management Console uses numerous JavaScript and CSS functions to display the web interface. Cookies need to be permitted in the browser. The following browsers are recommended:

  • Chrome as of version 71

  • Firefox as of version 60

  • Safari and Safari Mobile as of version 12

  • Microsoft Edge as of version 18

As of this release Internet Explorer is not supported by Univention Management Console anymore.

Users running older browsers may experience display or performance issues.

§Chapter 6. Changelog

Listed are the changes since UCS 4.4-3:

§6.1. General

§6.2. Basic system services

§6.2.1. Other system services

  • Move Python binding of univention-licence into separate package univention-licence-python and add Python 3 support (Bug 50943).

§6.3. Domain services

§6.3.1. OpenLDAP

  • The LDAP overlay module k5pwd used the default Kerberos salt to check the password during simple-bind. We now use the correct salt, found in the k5key itself (Bug 50492).

§6.3.1.1. Listener/Notifier domain replication

  • The LDAP overlay slapo-lastbind can now be activated via the Univention Configuration Registry variable ldap/overlay/lastbind which when activated stores the timestamp of an successful bind to an LDAP server. The script /usr/share/univention-ldap/univention_lastbind.py can be used to store the youngest of these timestamps, from all reachable LDAP servers, into the extended attribute lastbind of a specified user (Bug 49700).

§6.4. Univention Management Console

§6.4.1. Univention Management Console web interface

  • Fixed a typo in the description of Univention Configuration Registry variable ucs/server/languages/ (Bug 47845).
  • When accessing http(s)://FQDN/univention/udm/schema/ or http(s)://FQDN/univention/udm/openapi.json authentication is now required by default. ucr set directory/manager/rest/require-auth=no can be used to disable this. After setting this Univention Configuration Registry variable the univention-directory-manager-rest service needs to be restarted (Bug 50732).

§6.4.2. Univention Management Console server

  • Univention Management Console modules are now installed under Python 2 and/or Python 3 depending on what they provide (Bug 50332).
  • The How do I login? link on the login page can now be configured via the Univention Configuration Registry variable umc/login/links/how_do_i_login/.* (Bug 50609).
  • SAML answers do not provide a usable password for UMC. Some UMC actions require specifically this password and so the UMC frontend asks for credentials before executing them. This fix stores the password across different UMC modules so that users need to enter their password only once per session (Bug 50670).

§6.4.3. Univention App Center

  • Fixed the logic to identify the main service container for multi-container apps (Bug 50969).
  • Minor fix that makes it easier to change the timeout between calls for the App Center listener converter (Bug 50967).
  • Fixed an issue where installation of apps on remote UCS systems would not work when using wildcard SSL certificates (Bug 50770).
  • Reinitializing an installed app led to an unnecessary image pull. This fix skips this pull to increase the reinitialization speed (Bug 50938).
  • Added support for app_id=version in the app parameter for the UMC app install functions (Bug 50931).
  • Added DockerInjectEnvFile parameter for env file support in docker compose apps (Bug 50898).
  • Installing certain Apps on a non-Master system did not work via UMC (Bug 50890).
  • Added PostgreSQL pg_hba configuration for docker compose networks (Bug 50858).
  • The error tracking for failed docker pull requests has been improved (Bug 50849).
  • The warning message indicating a potentially long installation time of container based apps has been removed (Bug 50814).
  • Errors in a cached response in the UMC module could lead to tracebacks. This has been fixed (Bug 50775).
  • During app installation there was a mix of pop-up dialogs and dedicated pages. These have been unified into an installation wizard (Bug 50771).
  • In some cases, an unsuccessful app installation was still acknowledged as successful. This fix ensures that the App Center receives a correct status code for those cases (Bug 49104).
  • Empty app settings are no longer set to None when using univention-app reinitialize (Bug 50718).
  • Warnings and errors during an app installation, removal or upgrade are now highlighted and grouped together (Bug 50667).
  • A Promise was evaluated as resolved too early due to an missing return which caused standby animations to end too early. This has been addressed (Bug 50649).
  • The startup performance of the UMC module has been improved. Listing all apps first shows the cached result of the previous query while a new query is being performed. When the new query is done the cache is updated and the result is shown in the browser (Bug 49675).
  • The App Center will now check the available disk space before installing an App (Bug 31796).
  • The command univention-app dev-test-setup has been added that installs components needed to run Selenium based app tests (Bug 50592).

§6.4.4. Univention Directory Manager UMC modules and command line interface

  • An internal syntax check allowed spaces in mail addresses. This fix ensures that spaces in mail addresses now get rejected (Bug 46599).
  • Prevent creating DHCP networks which break the DHCP service configuration (Bug 44135).
  • The listener module udm_extension has been migrated to dh_python. All existing UDM extensions are migrated during the package upgrade (Bug 50401).

§6.4.5. Modules for system settings / setup wizard

  • Fixed symbolic link creation for host certificate (Bug 49036).

§6.4.6. Domain join module

  • An issue in the joinscript 20univention-join.inst to create new host certificates has been fixed, which led to directories getting the wrong file permissions (Bug 49036).

§6.4.7. License module

  • In case of an error during license activation in an appliance, refer to an article in the support database (Bug 50951).
  • Activating an app appliance now also sends the Univention Configuration Registry variables uuid/system for analytical purposes (Bug 49555).

§6.4.8. System diagnostic module

  • Added another diagnosis plugin 60_old_schema_registration.py: It searches for a defined set of LDAP schema files and offers to register them properly if they were added to the system using an outdated installation mechanism (Bug 50889).
  • An UMC diagnostic check has been added, which checks if Univention Configuration Registry variable ldap/server/name points to the master domain controller on member servers (Bug 50191).
  • A module to check if the LDAP module memberOf is activated has been added (Bug 50599).

§6.4.9. Other modules

  • The package has been migrated to dh-python and Python 3 (Bug 50461).

§6.5. Univention base libraries

  • The LDAP overlay slapo-lastbind can now be activated via the Univention Configuration Registry variable ldap/overlay/lastbind which when activated stores the time-stamp of a successful bind to an LDAP server. The script /usr/share/univention-ldap/univention_lastbind.py can be used to store the youngest of these timestamps, from all reachable LDAP servers, into the extended attribute lastbind of a specified user (Bug 49700).
  • The init script for slapd now looks for running process only below parent PID 1 specifically. This allows running other slapd processes in containers (Bug 50616).
  • The script ldap-group-to-file used to run against the master domain controller by default. We randomize the LDAP server selection now to distribute the load (Bug 50191).

§6.6. Software deployment

  • The wording of the univention-updater help text has been corrected (Bug 47834).

§6.6.1. Software monitor

  • The package now uses dh_python2 instead of python-support (Bug 49173).

§6.7. System services

§6.7.1. SAML

  • An issue in a translation file caused a web link to not appear in case a password was expired or had to be reset (Bug 50884).
  • A new UDM attribute signLogouts for the UDM module saml/serviceprovider has been implemented. Its value determines whether to sign logout messages sent to this service provider. Its default value is True (Bug 49305).
  • Error messages in the SAML login dialog are now translated to German again (Bug 50619).
  • The Login without Single Sign On link on the login page can now be configured via the Univention Configuration Registry variable umc/login/links/login_without_sso/.* (Bug 50610).
  • A link to the password changing functionality has been implemented in the SAML login dialog, which is shown when the user has to change his password or the password expired. The link target can be set with the Univention Configuration Registry variable saml/idp/password-change-url (Bug 50594).

§6.7.2. Univention self service

  • The Forgot your password? link on the login page can now be configured via the Univention Configuration Registry variable umc/login/links/forgot_your_password/.* (Bug 50608).

§6.7.3. Mail services

  • The schema file and the ACL file for Fetchmail are now properly registered using the newer ucs_registerLDAPExtension. This prevents errors when a backup domain controller is promoted to be the new master domain controller (Bug 50607).

§6.7.4. Postfix

  • In a fresh installation of univention-postgrey the files /etc/postgrey/whitelist_clients.local and /etc/postgrey/whitelist_recipients.local are not included in the Postgrey configuration, even though the corresponding Univention Configuration Registry variable should force this. The creation of the .local files and the update of the Postgrey configuration has been rearranged to fix this problem (Bug 50647).

§6.7.5. Printing services

  • The package now uses dh_python2 instead of python-support (Bug 49174).

§6.7.6. Apache

  • The timeout in univention-add-vhost has been increased (Bug 50936).
  • Make the package univention-apache-vhost a dependency of univention-apache rather than a recommendation. This way it gets installed by default; some Apps rely on it (Bug 50901).

§6.7.7. RADIUS

  • Various RADIUS-related Univention Configuration Registry variables have received a description text (Bug 48709).
  • For the logfile /var/log/univention/radius_ntlm_auth.log an automatic logrotate functionality has been added to prevent over-sized logfiles on heavy duty RADIUS servers (Bug 50545).
  • The package now uses dh_python2 instead of python-support (Bug 49175).

§6.7.8. Kerberos

  • Improve error messages (Bug 38736).
  • Fix many memory leaks, memory corruption and segmentation faults (Bug 49383).
  • Add Python 3 support (Bug 50475).

§6.7.9. SSL

  • An issue in the Univention Directory Listener module gencertificate.py to create new host certificates has been fixed, which led to directories getting the wrong file permissions (Bug 49036).

§6.7.10. Celery services

  • Unused Python code has been removed (Bug 49170).

§6.7.11. DHCP server

  • The new Univention Configuration Registry variable dhcpd/ldap/debug has been added for debugging the configuration from LDAP. If activated, it creates a log file named /var/log/dhcp-ldap-startup.log (Bug 49281).
  • Fixed a spelling mistake in the description of Univention Configuration Registry variable dhcpd/options/ (Bug 46805).

§6.7.12. PAM / Local group cache

  • Changed the default of nss/group/cachefile/check_member to false on new installations for improved performance (Bug 50904).
  • The script ldap-group-to-file used to run against the master domain controller by default. We randomize the LDAP server selection now to distribute the load (Bug 50191).

§6.8. Virtualization

§6.8.1. UCS Virtual Machine Manager (UVMM)

  • Handle state VIR_DOMAIN_PMSUSPENDED (Bug 50580).

§6.8.2. Operate UCS as virtual machine

  • The package now uses dh_python2 instead of python-support (Bug 49171).

§6.9. Services for Windows

§6.9.1. Univention S4 Connector

  • The Univention AD connector is now able to synchronize Kerberos hashes from the Active Directory to the UCS LDAP server. This update adds compatibility for the new feature to the Univention S4 connector (Bug 50492).
  • The group member cache handling has been improved to avoid unbound consumption of process memory (Bug 50644).
  • Microsoft Wireless/Wired Group Policy, IPsec policy and Software installation policy objects can now be synchronized between OpenLDAP and Samba 4 (Bug 49838).

§6.9.2. Univention Active Directory Connection

  • Fix the check check_univention_ad_connector by adapting to the new process name introduced in UCS 4.4-4 erratum 390 from Bug 49168 (Bug 50676).
  • When synchronizing group members, the Univention AD connector now only adds/deletes the edited members instead of replacing the whole list of members in that group (Bug 50630).
  • The Univention AD connector is now able to synchronize Kerberos hashes from the Active Directory to the UCS LDAP server. This can be enabled by setting the new Univention Configuration Registry variable connector/ad/mapping/user/password/kerberos/enabled=true. If this variable is not set the hashes will not be synchronized (Bug 50492).
  • Fix Python library path in prepare-new-instance. This fixes the feature to synchronize several Active Directory domains with one UCS directory service (Bug 50713).
  • It is now possible to filter out users from synchronization by setting the Univention Configuration Registry variable connector/ad/mapping/user/ignorefilter to an LDAP filter. Every user matched by this LDAP filter will be ignored by the connector (Bug 50674).
  • The group member cache handling has been improved to avoid unbound consumption of process memory (Bug 50643).
  • The package now uses dh_python2 instead of python-support (Bug 49168).