Source: https://docs.software-univention.de/release-notes-4.4-3-de.html
Timestamp: 2020-08-03 09:41:27+00:00

Document:
Release Notes für die Inbetriebnahme und Aktualisierung von Univention Corporate Server (UCS) 4.4-3
6.4.2. Univention Portal
6.4.3. Univention Management Console server
6.4.4. Univention App Center
6.4.5. Univention Directory Manager UMC modules and command line interface
6.4.6. Modules for system settings / setup wizard
6.4.7. Domain join module
6.4.8. Univention Directory Reports
6.4.9. License module
6.4.10. System diagnostic module
6.4.11. Process overview module
6.4.12. Policies
6.4.13. Filesystem quota module
6.4.14. Univention Configuration Registry module
6.4.15. Other modules
6.4.16. Development of modules for Univention Management Console
6.7.1. Docker
6.7.2. SAML
6.7.3. Univention self service
6.7.4. Dovecot
6.7.5. Nagios
6.7.7. SSL
6.7.8. Other services
6.9.1. Samba
6.9.2. Univention AD Takeover
6.9.3. Univention S4 Connector
6.10. Other changes
Mit Univention Corporate Server 4.4-3 steht das dritte Point-Release für Univention Corporate Server (UCS) 4.4 zur Verfügung. Es umfasst Funktionserweiterungen und Verbesserungen, neue Eigenschaften sowie diverse Detailverbesserungen und Fehlerkorrekturen. Die wichtigsten Änderungen im Überblick:
Die Univention Management Console wurde in Details verbessert: So wird nun schon während der Installation geprüft, ob genügend Arbeitsspeicher vorhanden ist. Beim Einrichten von Druckertreibern unterstützt eine neue Dokumentation, die direkt verlinkt ist. Die Suche nach IPv4-Adressen und die Konfiguration von E-Mail-Verteiler-Listen wurden vereinfacht.
Viele kleine Verbesserungen wurden im Univention S4 Connector umgesetzt, u.a. beim Umbenennen von Hosts- und DNS-Einträgen, Korrektur von Konto-Ablaufdaten für einige Zeitzonen und bei Sonderfällen beim Wiederherstellen von Objekten in UCS@school Umgebungen.
Ein Absturzproblem in OpenLDAP und ein Problem beim Zugriff auf Freigaben mit dem Windows Explorer wurde behoben.
Die meisten Pakete wurden von python-support auf dh_python2 als Vorbereitung für den Wechsel von Python 2 zu Python 3 umgestellt.
Diverse Security Updates wurden in UCS 4.4-3 integriert, bspw. für Samba, den Linux Kernel und OpenLDAP. Eine vollständige Liste von Security- und Paketupdates ist in Kapitel 6 zu finden.
Es sollte geprüft werden, ob ausreichend Festplattenplatz verfügbar ist. Eine Standard-Installation benötigt min. 10 GB Speicherplatz. Das Update benötigt je nach Umfang der vorhanden Installation ungefähr 4 GB zusätzlichen Speicherplatz zum Herunterladen und Installieren der Pakete.
Univention bietet ein Skript an, mit dem Probleme, die das Update des UCS Systems verhindern würden, schon vor dem Update erkannt werden können. Dieses Skript kann vor dem Update manuell auf das System geladen und ausgeführt werden:
gpgv --keyring /usr/share/keyrings/univention-archive-key-ucs-4x.gpg pre-update-checks-4.4.gpg \
pre-update-checks-4.4 && bash pre-update-checks-4.4
Bei Verwendung der UCS Core Edition werden anonyme Nutzungsstatistiken zur Verwendung von Univention Management Console erzeugt. Die aufgerufenen Module werden dabei von einer Instanz des Web-Traffic-Analyse-Tools Piwik protokolliert. Dies ermöglicht es Univention die Entwicklung von Univention Management Console besser auf das Kundeninteresse zuzuschneiden und Usability-Verbesserungen vorzunehmen.
Chrome ab Version 71
Firefox ab Version 60
Safari und Safari Mobile ab Version 12
Microsoft Edge ab Version 18
Der Internet Explorer wird ab diesem Release nicht mehr von Univention Management Console unterstützt.
Mit älteren Browsern können Darstellungs- oder Performanceprobleme auftreten.
Die Changelogs mit den detaillierten Änderungsinformationen werden nur in Englisch gepflegt. Aufgeführt sind die Änderungen seit UCS 4.4-2:
All security updates issued for UCS 4.4-2 are included:
apache2 (CVE-2019-10092) (Bug 50392)
e2fsprogs (CVE-2019-5094) (Bug 50298)
file (CVE-2019-18218) (Bug 50417)
firefox-esr (CVE-2019-11757 CVE-2019-11759 CVE-2019-11760 CVE-2019-11761 CVE-2019-11762 CVE-2019-11763 CVE-2019-11764 CVE-2019-15903) (Bug 50477)
ghostscript (Bug 50507)
intel-microcode (CVE-2019-11135 CVE-2019-11139) (Bug 50488)
libarchive (CVE-2019-18408 CVE-2019-1000019 CVE-2019-1000020) (Bug 50440)
linux (CVE-2018-12207 CVE-2019-0154 CVE-2019-0155 CVE-2019-11135 CVE-2019-14821 CVE-2019-14835 CVE-2019-15117 CVE-2019-15118 CVE-2019-15902) (Bug 50263 Bug 50486)
openjdk-8 (CVE-2019-2894 CVE-2019-2945 CVE-2019-2949 CVE-2019-2962 CVE-2019-2964 CVE-2019-2973 CVE-2019-2975 CVE-2019-2978 CVE-2019-2981 CVE-2019-2983 CVE-2019-2987 CVE-2019-2988 CVE-2019-2989 CVE-2019-2992 CVE-2019-2999) (Bug 50398)
openssl (CVE-2019-1547 CVE-2019-1563) (Bug 50352)
openssl1.0 (CVE-2019-1547 CVE-2019-1563) (Bug 50353)
php-imagick (CVE-2019-11037) (Bug 50547)
php7.0 (CVE-2019-11043) (Bug 50432)
postgresql-common (CVE-2019-3466) (Bug 50506)
proftpd-dfsg (CVE-2019-18217) (Bug 50464)
samba (CVE-2019-10218 CVE-2019-14833 CVE-2019-14847) (Bug 50400)
simplesamlphp (CVE-2019-3465) (Bug 50482)
subversion (Bug 50357)
sudo (CVE-2019-14287) (Bug 50367)
tcpdump (CVE-2017-16808 CVE-2018-10103 CVE-2018-10105 CVE-2018-14461 CVE-2018-14462 CVE-2018-14463 CVE-2018-14464 CVE-2018-14465 CVE-2018-14466 CVE-2018-14467 CVE-2018-14468 CVE-2018-14469 CVE-2018-14470 CVE-2018-14879 CVE-2018-14880 CVE-2018-14881 CVE-2018-14882 CVE-2018-16227 CVE-2018-16228 CVE-2018-16229 CVE-2018-16230 CVE-2018-16300 CVE-2018-16451 CVE-2018-16452 CVE-2019-15166) (Bug 50396)
univention-kernel-image-signed (CVE-2018-12207 CVE-2019-0154 CVE-2019-0155 CVE-2019-11135 CVE-2019-14821 CVE-2019-14835 CVE-2019-15117 CVE-2019-15118 CVE-2019-15902) (Bug 50263 Bug 50486)
The following updated packages from Debian 9.11 are included (Bug 50559): dpdk, mediawiki, pam-python, redmine, ruby-loofah, symfony, thunderbird
The following packages have been moved to the maintained repository of UCS: novnc (Bug 35428), python-debtcollector (Bug 35428), python-oslo.config (Bug 35428), python-oslo.i18n (Bug 35428), python-rfc3986 (Bug 35428), python-wrapt (Bug 35428), stevedore (Bug 35428), univention-ipcalc (Bug 49135), websockify (Bug 35428)
The package univention-licence now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/ (Bug 49137).
The package univention-doc now uses dh_python2 instead of python-support (Bug 49131).
Depending on database memory layout it could happen, that the OpenLDAP server process slapd failed to restart because it incurred a bus error (Bug 49780).
Update of LMDB to version from Debian 10 (Buster), which fixes several internal cursor handling problems (Bug 47587).
Remove unused file memcached_univention-directory-listener.conf (Bug 48139).
Add missing Univention Configuration Registry header to run script (Bug 50110).
Remove legacy code using DB3 database (Bug 50407).
Migrate Python code from python-support to dh_python2 (Bug 49146).
Explicitly close second database cursor when deleting cache entries (Bug 47587).
Progress bars were jumping up and down when the info text changed and the number of lines were different (Bug 33590).
The package univention-directory-manager-modules now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/admin/ (Bug 49147).
§6.4.2. Univention Portal
The package univention-server-overview now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49164, Bug 49161).
§6.4.3. Univention Management Console server
The UMC for UCS Core Editions shows a dialog that informs about the Univention Summit 2020 (Bug 50530).
The development package now uses a file from the translation package univention-ucs-translation-template instead of using its own mechanism for generating translation files (Bug 50341).
The LDAP service is not restarted anymore on every change of the attribute univentionService for any computer object in the domain (Bug 47706).
The package univention-appcenter now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/ (Bug 49161).
§6.4.4. Univention App Center
The package univention-app-appliance now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/app_appliance/ (Bug 49128).
Better error message are shown in case the LDAP schema registration fails (Bug 50481).
Added version check for global App Center (Bug 50450).
The package univention-appcenter now uses dh_python2 instead of python-support (Bug 50425).
Use univention-l10n-build to build localization files for univention-appcenter (Bug 50340, Bug 49161).
InitialValue of App Settings is now working for settings with a defined scope of outside (Bug 50203).
§6.4.5. Univention Directory Manager UMC modules and command line interface
Fix regression from UCS 4.4-3 erratum 349, which could lead to a Python traceback during Univention Directory Manager hook import (Bug 50495).
Prevent TypeError during logging of invalid date values in the UDM REST service (Bug 50476).
A link to a support article for printer driver distribution is now shown in the UMC printers module (Bug 50376).
Fix regression from UCS 4.4-3 erratum 348, which could lead to a Python traceback during UDM module import, in cases where modules had been installed under the legacy path /usr/share/pyshared, like e.g. the mailquota module (Bug 50493).
The gidNumber and sambaPrimaryGroupSID of users/user is now set during the object creation instead of setting it afterwards (Bug 50161).
Searching for the IP address property of computer objects now also searches for IPv6 addresses (Bug 49313).
The properties allowedEmailUsers and allowedEmailGroups of groups/group and mail/lists have been added to the UDM module mapping (Bug 50239).
Some code cleanup in the UDM users/user filter for disabled and locked properties has been done (Bug 50236).
The DHCP assignment for computers with multiple MAC addresses has been repaired (Bug 44937).
The logging and error handling when removing child objects has been improved (Bug 50288).
§6.4.6. Modules for system settings / setup wizard
The package univention-management-console-module-ipchange now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ ^(Bug 49152, Bug 49161).
A warning is shown if the minimum RAM requirements to install UCS are not met (Bug 50448).
The package univention-system-setup now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49142).
§6.4.7. Domain join module
The new tool univention-fetch-certificate is used during join (Bug 45115).
The package univention-join now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49149, Bug 49161).
Automatically apply the master domain controller settings of the Univention Configuration Registry variables ldap/database/mdb/maxsize and listener/cache/mdb/maxsize on backup domain controller and slave domain controller systems during the join (Bug 50114).
§6.4.8. Univention Directory Reports
The package univention-directory-reports now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/directory/ (Bug 49148).
§6.4.9. License module
Fixed an error while loading the System Activation Wizard (Bug 50267).
§6.4.10. System diagnostic module
A broken test for filesystem permissions has been removed (Bug 50394).
The package univention-management-console-module-diagnostic now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49151).
§6.4.11. Process overview module
The package univention-management-console-module-top now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49158).
§6.4.12. Policies
The package univention-policy now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/lib/ (Bug 49138).
§6.4.13. Filesystem quota module
The package univention-quota now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49141).
§6.4.14. Univention Configuration Registry module
The package univention-management-console-module-ucr now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49159).
§6.4.15. Other modules
The package univention-system-info now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49165).
The package ships the directory /usr/share/univention-management-console-module-udm/ again. This is necessary for creation of reports and has been broken in UCS 4.4-3 erratum 346 (Bug 50497).
UDM handlers are now able to display help texts in their UMC module (Bug 50376).
The package univention-management-console-module-udm now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49160).
The package univention-management-console-module-mrtg now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49154, Bug 49161).
§6.4.16. Development of modules for Univention Management Console
The package univention-management-console-module-lib now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49153, Bug 49161).
The listener module ldap_extension now stores success or error messages in a new LDAP attribute univentionListenerMessage. These are used in the App center to improve error messages (Bug 50481).
The objectClass top is now automatically added to the container cn=dns,$LDAP_BASE, when the LDAP is initially provisioned. Existing systems are not modified (Bug 46649).
Added set/get_handler_message to store/get listener messages in the LDAP directory (as settings data object) (Bug 50481).
Remove deprecated module univention.lib.umc_connection (Bug 47205).
The package univention-updater now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/updater/ and /usr/lib/python2.7/dist-packages/univention/management/console/modules/updater/ (Bug 49143).
§6.7.1. Docker
Added file daemon.json for dockerd parameters (Bug 50295).
§6.7.2. SAML
It is now possible to make the SAML Identity Provider accessible under multiple URL sub-paths, each with its own entityID but with the same configuration. This has been added to use the SAML Identity Provider with multiple Azure domains (Bug 50510).
The UDM modules saml/idpconfig and saml/serviceprovider have been modernized (Bug 50345).
The package univention-saml now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/admin/handlers/ (Bug 49167).
Is is now possible to restrict negotiate authentication to certain IP networks via the Univention Configuration Registry variable saml/idp/negotiate/filter-subnets (Bug 49485).
§6.7.3. Univention self service
The package univention-self-service now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49163).
The LDAP ACLs have been improved to allow UCS@school users to use the self service feature (Bug 50037).
§6.7.4. Dovecot
The package univention-mail-dovecot now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/mail/ (Bug 49144).
§6.7.5. Nagios
Improve Nagios check for nscd to check for a working nscd by querying its statistics data (Bug 49967).
A new package univention-apache-vhost has been added. It is installed by default and ships a Univention Configuration Registry template to hold virtual hosts for Apache beyond the default ones. A new tool univention-add-vhost has been added to add (and remove) these virtual hosts (Bug 45115).
§6.7.7. SSL
If the service Wildcard Certificate is added to a host, a wildcard certificate for that host is created (*.$fqhn) on the master domain controller. A new tool univention-fetch-certificate has been added to simplify the download of certificates from the master domain controller (Bug 45115).
§6.7.8. Other services
Repaired firewall rules regarding docker networks getting broken after a restart of the firewall (Bug 50088).
The package univention-management-console-module-services now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/uvmm/ (Bug 49157, Bug 49161).
The package univention-management-console-module-reboot now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/uvmm/ (Bug 49156, Bug 49161).
The package univention-virtual-machine-manager-daemon now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/uvmm/ (Bug 49179).
Allow to migrate VMs again after failure (Bug 50092).
The package univention-virtual-machine-manager-schema now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/admin/ (Bug 49181).
The package novnc from Debian Buster is now used (Bug 35428).
The package univention-virtual-machine-manager-node has been prepared for Python 3 (Bug 49180).
§6.9.1. Samba
Samba does not recognizing Unix SIDs as valid. This causes Microsoft Windows explorer to crash when opening the security tab on a share or file where such SIDs are present in the ACLs (Bug 49747).
§6.9.2. Univention AD Takeover
The package univention-management-console-module-adtakeover now uses dh_python2 instead of python-support. Therefore Python modules are installed into /usr/lib/python2.7/dist-packages/univention/management/console/modules/ (Bug 49150).
§6.9.3. Univention S4 Connector
Recreating user and group objects which have been deleted before used to cause rejects in UCS@school (Bug 49792).
Time conversion of the attribute accountExpires/userexpiry has been fixed to prevent a loop in the Univention S4 connector which incremented userexpiry on certain timezones (Bug 50202).
Renamed DNS records are now correctly removed from Samba/AD when the object in UCS was renamed (Bug 49728).
DNS host records without IP addresses are now synchronized to Samba/AD (Bug 49874).
The UDM modules container/msgpo, settings/msprintconnectionpolicy and settings/mswmifilter have been modernized (Bug 50342).
The use of the function normalise_userAccountControl() has been replaced in mapping.py with a static mapping (Bug 50305).
Detection of equal DN's when moving objects has been enhanced (Bug 49976).
Error handling for already removed objects has been improved (Bug 49876).
Logging of UDM related debug messages has been improved. This can be controlled by the Univention Configuration Registry variable connector/debug/udm/level (Bug 43096).
Removal of GPOs in Samba does not cause a reject anymore. When objects are removed where the parent object is already removed the removal now succeeds (Bug 49324).
§6.10. Other changes
Add documentation for .univention-l10n format (Bug 50521).
univention-l10n-build now runs without any UCS dependency and recognizes UMC .po files (Bug 50341).

References: §6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6