Source: https://docs.software-univention.de/release-notes-4.0-0-de.html
Timestamp: 2019-11-21 09:11:05+00:00

Document:
UCS 4.0-0 Release Notes
Release Notes für die Inbetriebnahme und Aktualisierung von Univention Corporate Server (UCS) 4.0-0
2.2. Mischbetrieb mit älteren UCS-Systemen
2.3. Univention App Center
2.4. Ablösung von Windows NT DC Funktionalität
2.5. UCS-Installations-DVDs nur noch als 64-Bit-Variante
3.1. Entfernte/nicht mehr unterstützte Komponenten
5.1. Netzwerkinstallation von UCS
5.2. Erfassung von Nutzungsstatistiken
5.3. Umfang des Sicherheits-Supports von WebKit, Konqueror und QtWebKit
5.4. Empfohlene Browser für den Zugriff auf Univention Management Console
5.5. Automatische Kontosperrung
6.2. Univention Installer
6.3. Basic system services
6.3.1. Linux kernel and firmware packages
6.3.2. Boot Loader
6.4. Domain services
6.4.1. OpenLDAP
6.4.1.1. LDAP ACL changes
6.4.2. DNS server
6.5. Univention Management Console
6.5.1. Univention Management Console web interface
6.5.2. Univention Management Console server
6.5.3. Univention App Center
6.5.4. Basic settings / Appliance mode
6.5.5. Users module
6.5.6. Computers module
6.5.7. Shares module
6.5.8. Policies
6.5.9. Printers module
6.5.10. Mail
6.5.11. Filesystem quota module
6.5.12. Other modules
6.5.13. Univention Directory Manager command line interface and related tools
6.5.14. Development of modules for Univention Management Console
6.7. Univention Library
6.8. System services
6.8.1. Mail services
6.8.2. Spam/virus detection and countermeasures
6.8.3. Printing services
6.8.4. Proxy services
6.9. Virtualization
6.9.1. Univention Virtual Machine Manager (UVMM)
6.9.2. Operate UCS as virtual machine
6.10.4. Univention Active Directory Connector
Mit Univention Corporate Server 4.0 steht das vierte Major Release für Univention Corporate Server (UCS) zur Verfügung. Es umfasst eine Reihe umfangreicher Funktionserweiterungen und Verbesserungen, neue Eigenschaften sowie diverse Detailverbesserungen und Fehlerkorrekturen. Die wichtigsten Änderungen im Überblick:
Das Design und die Usability der graphischen Administrationsoberfläche Univention Management Console wurde mit UCS 4.0 komplett überarbeitet. Durch ein Responsive Design kann die Administration auch bequem vom Tablet oder Smartphone aus erfolgen.
UCS Virtual Machine Manager (UVMM) kann neben lokalen UCS Virtualisierungsservern nun auch OpenStack- oder Amazon EC2-Umgebungen administrieren. Dadurch sind hybride Cloud Szenarien mit UCS Out-of-the-Box möglich.
UCS 4.0 basiert auf Debian GNU/Linux 7.7 (Wheezy). Mehr als 16.000 Source Pakete wurden aktualisiert und an die Bedürfnisse der UCS-Administratoren angepasst. Einige Kernkomponenten, wie OpenLDAP (2.4.40), Samba (4.2rc2) oder der Linux Kernel (3.16) sind in UCS 4.0 aktueller als in Debian GNU/Linux 7.7.
Die Installation von UCS wurde deutlich vereinfacht. Die Basis-Installation erfolgt mit Hilfe des Debian Installers und wird mit der Web-basierten Konfiguration des Systems abgeschlossen. Die Web-basierte Konfiguration kommt auch bei der manuellen Konfiguration von Cloud-Images oder anderen Appliances zum Einsatz.
Die Performance des OpenLDAP-Verzeichnisdienstes wurde deutlich verbessert. Standardmäßig wird bei einer Neuinstallation als Backend für OpenLDAP nun die Memory-Mapped-Datenbank (MDB) verwendet.
Die Administration von Applikationen innerhalb der UCS-Domäne wird durch ein zentralisiertes App Center noch weiter vereinfacht. Applikationen können nun über das App Center auf einem beliebigen UCS-System innerhalb der Domäne installiert werden.
UCS unterstützt nun auch die Installation auf Systemen mit aktiviertem UEFI SecureBoot.
Während der Aktualisierung kann es zu Ausfällen von Diensten innerhalb der Domäne kommen. Aus diesem Grund sollte das Update innerhalb eines Wartungsfensters erfolgen. Grundsätzlich wird empfohlen das Update zunächst in einer Testumgebung einzuspielen und zu testen. Die Testumgebung sollte dabei identisch zur Produktivumgebung sein. Je nach Systemgeschwindigkeit, Netzwerkanbindung und installierter Software kann das Update zwischen dreißig Minuten und mehreren Stunden dauern.
§2.2. Mischbetrieb mit älteren UCS-Systemen
UCS 4.0 unterstützt den Mischbetrieb mit UCS 3.2-4 Systemen. Aus diesem Grund müssen nicht alle UCS-Systeme in einem Wartungsfenster auf UCS 4.0 aktualisiert werden. Ein Mischbetrieb mit älteren UCS-Versionen, bspw. UCS 3.1 wird nicht unterstützt.
§2.3. Univention App Center
Sofern Applikationen aus dem App Center installiert sind, ist das Update erst dann möglich, wenn alle lokal installierten Applikationen im App Center verfügbar sind. Einige Applikationen werden beim Update ebenfalls auf neuere Versionen aktualisiert. Sollte eine Applikation noch nicht für UCS 4.0 verfügbar sein, kann der Zeitpunkt der Veröffentlichung beim Applikationshersteller nachgefragt werden.
Falls Univention Corporate Client 1.0 im Einsatz ist und ein Update auf Univention Corporate Client 2.0 noch nicht erfolgen soll, so sollte vor dem Update auf UCS 4.0 auf die letzte verfügbare Univention Corporate Client 1.0 Version aktualisiert werden. Dies kann mit dem folgenden Befehlen durchgeführt werden:
eval "$(ucr shell version/version version/patchlevel)"
univention-add-app ucc_20140115
univention-upgrade --updateto $version_version-$version_patchlevel
Eine detaillierte Übersicht zu den Änderungen ist in den UCC 1.0 rev3 Release Notes beschrieben: http://updates.software-univention.de/doc/release-notes-ucc-1.0-rev3.pdf.
§2.4. Ablösung von Windows NT DC Funktionalität
Die Verwendung von Windows NT Domänendiensten, die klassisch durch Samba 3 bereitgestellt wurden, wird mit UCS 4.0 nicht mehr empfohlen. Eine Auswahl der Windows NT Domänendienste ist deshalb während der Installation von UCS und durch das App Center nicht mehr vorgesehen. Es wird empfohlen auf die Active Directory Domänendienste von UCS (Samba 4) zu migrieren. Die Migration ist im Univention Wiki dokumentiert: http://wiki.univention.de/index.php?title=Migration_from_Samba_3_to_Samba_4.
§2.5. UCS-Installations-DVDs nur noch als 64-Bit-Variante
UCS-Installations-DVSs werden ab UCS 4 nur noch für 64-Bit-Archtitekturen bereitgestellt. Vorhandene 32-Bit UCS 3 Systeme können weiterhin über das Online Repository oder über Update DVDs auf UCS 4 aktualisiert werden. Die 32-Bit-Archtitektur wird für die gesamte UCS 4 Maintenance noch unterstützt.
Es sollte geprüft werden, ob ausreichend Festplattenplatz verfügbar ist. Eine Standard-Installation benötigt min. 6 GB Speicherplatz. Das Update benötigt je nach Umfang der vorhanden Installation ungefähr 4 GB weiteren Speicherplatz zum Herunterladen und Installieren der Pakete.
Eine Remote-Aktualisierung über SSH wird nicht empfohlen, da dies beispielsweise bei Unterbrechung der Netzverbindung zum Abbruch des Update-Vorgangs und zu einer Beeinträchtigung des Systems führen kann. Sollte dennoch eine Aktualisierung über eine Netzverbindung durchgeführt werden, ist sicherzustellen, dass das Update bei Unterbrechung der Netzverbindung trotzdem weiterläuft. Hierfür können beispielsweise die Tools screen oder at eingesetzt werden, die auf allen Systemrollen installiert sind.
§3.1. Entfernte/nicht mehr unterstützte Komponenten
Einige Komponenten sind entfernt worden und werden mit UCS 4.0 nicht mehr ausgeliefert:
Der Xen Hypervisor wurde entfernt und wird nicht länger von UCS Virtual Machine Manager unterstützt. Details zur Migration zu KVM befinden sich in [ext-doc-uvmm].
Das Scalix LDAP Schema wurde in UCS 4.0 entfernt. Alle Scalix spezifischen Attribute müssen vor dem Update aus dem LDAP-Verzeichnis entfernt werden.
PostgreSQL-8.3 wurde in UCS 4.0 entfernt. Die Daten müssen von Hand in eine neuere Version migriert werden. Das Vorgehen ist in SDB 1220 beschrieben.
Cyrus-2.2 wurde in UCS 4.0 entfernt. Die Mailserverdaten müssen von Hand in eine neuere Version migriert werden. Das Vorgehen ist in SDB 1213 beschrieben.
Wenn die Applikation UCS Virtual Machine Manager zusammen mit KVM-Virtualisierungsservern vor dem Update in der Domäne betrieben wurde, müssen die mit dem Update hinzugekommenen Profile für virtuelle Maschinen mit UCS 4.0 angepasst werden. Wenn das Bridge-Interface auf den KVM Servern nicht br0 ist, sollte das Profil entsprechend der Beschreibung in [ucs-uvmm-profile] angepasst werden.
§5.1. Netzwerkinstallation von UCS
Die Profil-basierte Netzwerkinstallation von UCS steht mit UCS 4.0-0 noch nicht zur Verfügung. Die Unterstützung wird zu einem späteren Zeitpunkt nachgeliefert. Der Status kann in unserem Issue-Tracker nachvollzogen werden: Bug 35537.
Bei Verwendung der Free for personal use-Version von UCS (die in der Regel für Evaluationen von UCS herangezogen wird) werden anonyme Nutzungsstatistiken zur Verwendung von Univention Management Console erzeugt. Die aufgerufenen Module werden dabei von einer Instanz des Web-Traffic-Analyse-Tools Piwik protokolliert. Dies ermöglicht es Univention die Entwicklung von Univention Management Console besser auf das Kundeninteresse zuzuschneiden und Usability-Verbesserungen vorzunehmen.
Diese Protokollierung erfolgt nur bei Verwendung der Free-for-Personal-Use-Lizenz. Der Lizenzstatus kann überprüft werden durch den Eintrag Lizenz -> Lizenzinformation des Benutzermenüs in der rechten, oberen Ecke von Univention Management Console. Steht hier unter LDAP-Basis Free for personal use edition wird eine solche Version verwendet. Bei Einsatz einer regulären UCS-Lizenz erfolgt keine Teilnahme an der Nutzungsstatistik.
Chrome ab Version 33
Safari und Safari Mobile ab Version 7
§5.5. Automatische Kontosperrung
Auf Domänencontrollern mit MDB LDAP Backend (z.B. Systeme, die mit UCS 4.0 installiert worden sind) kann nun eine automatisierte Kontosperrungen bei wiederholten LDAP-Authentisierungsfehlern aktiviert werden. Die Aktivierung ist in SDB 1291 beschrieben.
Die Changelogs mit den detaillierten Änderungsinformationen werden nur in Englisch gepflegt. Aufgeführt sind die Änderung seit UCS 3.2-4:
The underlying Debian version has been updated to Debian GNU/Linux 7.7 (Wheezy) (Bug 33835, Bug 33836. Bug 35688, Bug 36241, Bug 36481, Bug 36525).
All Univention packages have been adapted to Dephelper 9 and to Python 2.7. UCR templates have been adapted to the new upstream packages (Bug 33836, Bug 35135, Bug 35138, Bug 35143, Bug 35144, Bug 35145, Bug 35146, Bug 35147, Bug 35264, Bug 35265, Bug 35266, Bug 35267, Bug 35320, Bug 35358, Bug 35431, Bug 35425, Bug 35664, Bug 35669, Bug 35828, Bug 35931, Bug 36051, Bug 36114, Bug 36178, Bug 33278, Bug 35890, Bug 36115, Bug 36177, Bug 36286, Bug 36526, Bug 36589, Bug 36637, Bug 36653, Bug 36654).
The codename for UCS 4.0 has been set to Walle (Bug 35312).
The maintained Java version in UCS 4.0 is OpenJDK 7. If OpenJDK 6 is installed, the upgrade process replaces it with OpenJDK 7. The migration can be skipped by setting the Univention Configuration Registry variable update40/skip/openjdk7 to true (Bug 35382).
The packages mingetty and parted have been copied to maintained (Bug 36231).
UEFI SecureBoot support has been added (Bug 28191, Bug 35918).
The UCS installation DVD has been revised. The installation is now performed by an adapted version of the Debian installer (Bug 30547, Bug 34994, Bug 35370, Bug 35371, Bug 35372, Bug 35373, Bug 35374, Bug 35375, Bug 35376, Bug 35377, Bug 35378, Bug 35384, Bug 35385, Bug 35386, Bug 35400, Bug 35417, Bug 35435, Bug 35491, Bug 35493, Bug 35494, Bug 35495, Bug 35496, Bug 35497, Bug 35498, Bug 35525, Bug 35635, Bug 35636, Bug 35659, Bug 35670, Bug 35696. Bug 35699, Bug 35932, Bug 35933, Bug 36085, Bug 36331).
§6.3. Basic system services
§6.3.1. Linux kernel and firmware packages
The Linux kernel has been updated to 3.16.5 (Bug 33844, Bug 36279).
The packages amd64-microcode and intel-microcode were added and are installed by default to provide micro-code updates for AMD and Intel CPUs (Bug 34437).
The packages virtualbox, open-vm-tools, iscsitarget, openafs, xtables-addons, ndiswrapper, blktap have been updated to newer versions from Debian to support the Linux kernel 3.16. The package openswan has been removed as it's incompatible with said kernel and is unmaintained (Bug #35875).
The kernel modules are signed to support boot on SecureBoot UEFI systems (Bug 36335).
§6.3.2. Boot Loader
The boot loader design has been adapted for UCS 4.0 (Bug 35934).
The design of the bootsplash has been adapted for UCS 4.0 (Bug 35935).
The kernel boot option vga is deprecated and has been replaced with grub's gfxpayload to control the video mode in which the Linux kernel starts up (Bug 28604).
If UCS 4.0 is installed as Xen HVM system, the grub gfxmode (Univention Configuration Registry variable grub/gfxmode) is now set to "text", otherwise the grub menu is invisible (Bug 30978).
If UCS 4.0 is installed on an UEFI system, the boot process includes a shim which is signed by Microsoft to support boot on SecureBoot UEFI systems (Bug 35914 Bug 35915).
Patches for the security issues CVE-2014-3675, CVE-2014-3676, and CVE-2014-3677 have been added to the shim (Bug 36167).
If UCS 4.0 is installed on an UEFI system, the boot process includes a signed GRUB bootloader to support boot on SecureBoot UEFI systems (Bug 35917).
The boot process includes a signed Linux kernel to support boot on SecureBoot UEFI systems (Bug 35916).
§6.4. Domain services
§6.4.1. OpenLDAP
OpenLDAP has been updated to version 2.4.40 (Bug 35697).
MDB is the new default backend database for OpenLDAP. The backend database can be configured via Univention Configuration Registry variable ldap/database/type. The backend is not changed during the update. More information about MDB can be found in the performance guide: [ucs-performance-guide] (Bug 34994, Bug 36725).
The default search rule for the LDAP attribute univentionInventoryNumber has been adjusted to make searches case insensitive (Bug 34262).
On domain controllers using the MDB LDAP backend (e.g. systems installed with UCS 4.0) automatic account lockout in cases of repeated LDAP authentication failures can be activated. All domaincontrollers need to be updated to UCS 4.0 before activating this. A default configuration for this is stored in OpenLDAP. The overlay and this default configuration can be activated on a per-DC basis by setting both Univention Configuration Registry variables ldap/ppolicy and ldap/ppolicy/enabled to yes and restarting the slapd daemon. The default policy is such that 5 repeated LDAP authentication failures within a monitoring interval of 5 minutes causes the authenticating account to be locked in UDM. A locked account can only be unlocked via UDM by a Domain Admin. The number of repeated LDAP authentication failures can be adjusted in the configuration object which has the objectClass pwdPolicy. The attribute pwdMaxFailure determines the number of LDAP authentication errors before lockout. The attribute pwdMaxFailure determines the time interval in seconds which is considered: LDAP authentication failures outside of that interval are neglected in the counting. Other attributes of this objectclass should not be adjusted (Bug 31907).
The python library univention.uldap removes the base object from the search result if the search scope one was used. Thus the behavior is identical between BDB and MDB (Bug 36169).
The Scalix schema has been removed. The update will be blocked until all Scalix related attributes have been removed from the LDAP server of the UCS domain (Bug 28693).
LDAP indices for the attributes shadowMax, shadowExpire and univentionUDMOptionModule have been added (Bug 36215, Bug 36671,).
Domain controllers and member servers have now the permission to create LDAP objects for cloud connections (Bug 36323).
§6.4.2. DNS server
The DNS server bind has been updated to Version 9.8.4P1 (Bug 35668)
During the configuration of univention-bind the currently configured nameservers are set as DNS forwarders (Bug 36039).
§6.5. Univention Management Console
§6.5.1. Univention Management Console web interface
The web interface design has been completely revised also with respect to its rendering on mobile devices (responsive design). Along with this change many details of UMC have been adapted accordingly (Bug 35654, Bug 35499, Bug 36095).
The browser compatibility list has been updated to Chrome as of version 33, Firefox as of version 24, Internet Explorer as of version 9 and Safari and Safari Mobile as of version 7 (Bug 33970).
The change of an expired password via UMC has been corrected (Bug 35985).
The redirection when doing single sign on in Univention Management Console has been adapted to keep a secure https connection (Bug 36617).
The module now ships an initial archive of the ini files which is used in case no network connection is available when the App Center is queried for the first time (Bug 35683).
The Univention App Center now allows to install, uninstall, update applications domain wide. Each App Center module can manage any application (Bug 35781, Bug 36370).
Several text refinements (Bug 36433).
§6.5.4. Basic settings / Appliance mode
An option to configure the system as a member of an existing AD domain has been added (Bug 35653, Bug 36110, Bug 36049).
An option to configure the system as a basesystem without any domain integration has been added (Bug 35805).
During the UCS installation some fields which are already configured will be hidden in the system setup wizard (Bug 35685).
Certain setup scripts are weighted differently in the progress bar (Bug 35715).
The dpkg messages presented in the progress bar when installing software packages have been reduced (Bug 35716).
Various text changes have been made and typos have been corrected (Bug 35703, Bug 36666, Bug 36667).
An option to upgrade the system right after the configuration has been added (Bug 33839).
The SSH host key and the DH parameter files for postfix are re-created during the appliance setup (Bug 36033).
The package univention-system-setup-boot is automatically removed after a successful installation (Bug 35727).
The keyboard settings have been improved (Bug 35709).
System setup cleanup scripts are now called via an at job in order to avoid problems while UMC server components are restarted (Bug 36543).
When the Univention Configuration Registry variable windows/domain is derived from the domain name it is automatically truncated to up to 15 characters to conform to netbios restrictions (Bug 36459).
The German firefox package is installed if a desktop environment should be installed and German has been chosen as system language (Bug 36528).
§6.5.5. Users module
The user picture is now shown on the left side of the detail page (Bug 23665)
§6.5.6. Computers module
Due to the new UCS installer the property interactive installation is no longer required at the computer objects for UCS domaincontrollers and memberservers and has been removed (Bug 35537)
§6.5.7. Shares module
The UMC description for the samba share name has been changed to Windows name (Bug 36311).
§6.5.8. Policies
Help text as well as a documentation link have been added to the policies module (Bug 36435).
§6.5.9. Printers module
A hint is shown when using this module while no printer server (CUPS) is installed in the domain (Bug 36260).
A documentation link has been added to the printers module (Bug 32026).
§6.5.10. Mail
The text fields got more precise names (Bug 36301).
§6.5.11. Filesystem quota module
The handling of activation, deactivation and detection of filesystem quota has been improved (Bug 36207).
The usability of the Filesystem quota module has been enhanced (Bug 36434).
§6.5.12. Other modules
The terminal server sessions have been removed from the statistic module (Bug 34029).
The reboot module has been removed from the UMC overview. The UMC menu now contains buttons for rebooting and shutting down the server. (Bug 36281).
Graphics containing the Windows logo have been replaced with alternate icons in the modules Active Directory Connection and Active Directory Takeover (Bug 35837).
Several text refinements (Bug 36435).
The users/self module is no longer used for password changes. The module has been renamed into "User settings" and is deactivated by default. Instead a new module "Change Password" has been added which uses the PAM stack to change user password. Every UMC user is able to use this new module (Bug 35847).
A module System diagnostic has been added to UMC which is able to analyse the system for known problems and helps to resolve them (Bug 34765), (Bug 35866), (Bug 35864).
The functionality to reboot or shutdown the server has been added to the UMC menu (Bug 36281).
§6.5.13. Univention Directory Manager command line interface and related tools
Two helper scripts have been added lock_expired_accounts and lock_expired_passwords (Bug 36215).
§6.5.14. Development of modules for Univention Management Console
UMC modules now may contain a help button which links to related article in the online documentation of UCS (Bug 32026, Bug 36435).
Signature verification for package files is now already enabled during UCS installation (Bug 35708).
The updater scripts preup.sh and postup.sh have been adapted to the needs of UCS 4.0 ( Bug 36205, Bug 36218, Bug 36228, Bug 36229, Bug 36441, Bug 36455, Bug 36554, Bug 36558, Bug 36618, Bug 36619, Bug 36620, Bug 36769 ).
Before and after the update, the updater now runs apt-get autoremove to deinstall obsolete packages (e.g. packages that were automatically installed but are now no longer referenced by other packages). This can be disabled by setting the Univention Configuration Registry variable update40/skip/autoremove to true. (Bug 36265).
With UCS 4.0 the data structure of UCS installation DVDs has changed. The command univention-repository-create is still able to create a local repository from any type of UCS DVD (old or new data structure). But as of UCS 4.0 the PXE installation of UCS system prior to UCS 4 is no longer supported. Therefore univention-repository-create will not copy PXE installation data from UCS DVDs with old data structure (Bug 36269).
§6.7. Univention Library
The new version of the package python-ldap caused the univention.uldap implementation to retry failed connects too many times. This has been fixed (Bug 35841, Bug 35852).
The reconnect feature of univention.uldap resulted in invalid access errors in the S4 Connector after a samba restart. To avoid this, the S4 Connector turns off the reconnect feature for the access to the samba directory service (Bug 36227).
The package python-univention-lib now depends on the package python-imaging (Bug 36037).
§6.8. System services
§6.8.1. Mail services
The Univention Configuration Registry variables mail/postfix/smtpd/tls/eecdh/grade and mail/postfix/tls/preempt/cipherlist have been added to allow better configuration of postfix's perfect forward secrecy (Bug 35923).
If the package univention-spamassassin is installed, the email spam check is enabled during the update. The spam check can be disabled by setting the Univention Configuration Registry variable mail/antivir/spam to false after the update (Bug 36524).
A new Univention Configuration Registry script has been added to update /etc/aliases.db if mail/alias/* variables are set (Bug 31837).
The spamassassin rules are now updated during the installation of the package univention-spamassassin (Bug 36607).
§6.8.2. Spam/virus detection and countermeasures
The freshclam postinst does not abort if the freshclam daemon start failed (Bug 36230).
§6.8.3. Printing services
The printer models in the join script of univention-printserver have been updated (Bug 35147).
Reloading of Samba for configuration changes has been improved in the cups-printers listener (Bug 36578).
§6.8.4. Proxy services
The configuration file of Squid has been adapted for UCS 4.0 and UCS@school. E.g. the path to the squidguard configuration file has been changed to its new location /etc/squidguard/squidGuard.conf. (Bug 36780).
§6.9. Virtualization
§6.9.1. Univention Virtual Machine Manager (UVMM)
Univention Virtual Machine Manager now supports connections to Cloud Computing Environments e.g. to OpenStack (Bug 32842). The following additional changes and bug fixes were made during UCS 4 UCS Virtual Machine Manager development: ( Bug 36139, Bug 36145, Bug 35824, Bug 35946, Bug 35982, Bug 36053, Bug 36133, Bug 36136, Bug 36138, Bug 36140, Bug 36093, Bug 36142, Bug 36143, Bug 36147, Bug 36148, Bug 36151, Bug 36152, Bug 36155, Bug 36305, Bug 36306, Bug 36135, Bug 36146)
Several packages related to virtualization have been updated to newer versions: libiscsi (1.12.0.2), libusb-1.0 (1.0.19), usbredir (0.6.2), spice-protocol (0.12.6), spice (0.12.4), libvirt (1.2.7), libvirt-python (1.2.6) (Bug 35768, Bug 36388).
The VirtIO drivers for Windows have been updated to version 0.1.81 (Bug 36122).
Support for Xen has been removed from UCS Virtual Machine Manager (Bug 35656).
The notification message about the changeability of instance settings has been removed (Bug 36307).
The default UCS Virtual Machine Manager loglevel has been increased to INFO (Bug 36136).
The CPU field is no longer flagged as invalid when creating a virtual machine (Bug 34515).
§6.9.2. Operate UCS as virtual machine
The new package univention-cloud-init provides support when setting up UCS as a virtual machine guest in an environment which offers cloud-init compatible services (Bug 36092).
Samba has been updated to version 4.2rc2 (Bug 35319, Bug 35766, Bug 36090, Bug 36101).
net idmap secret has been renamed to net idmap set secret (Bug 35765).
Installation of univention-samba now doesn't any longer automatically run the joinscript. This is because the join process requires administrative credentials (Bug 36284).
When installing the App Active Directory-compatible Domain Controller on a DC Slave the joinscript aborts now if an S4 Connector has already been installed on the DC Master or on a DC Backup. Additionally the S4 Connector package is installed in this case for purely technical reasons but it is not activated (Bug 35983).
The environment variable SMB_CONF_PATH is set during the univention-samba join to ensure the right configuration is used (Bug 36734).
The environment variable SMB_CONF_PATH is set during the univention-samba4 join to ensure the right configuration is used (Bug 36806).
When windows/wins-support was not set samba complained about an empty value in smb.conf This has been fixed (Bug 33261).
Samba3 to Samba4 in-place migration failed with Samba 4.2 because the new smb.conf validation code complained about empty values in smb.conf (Bug 36814).
An LDAP search timeout of the AD-Takeover has been fixed which could occur in cases where the transfer of the AD objects takes a long time (Bug 36639).
A traceback in the cleanup code of the s4-connector listener has been fixed (Bug 32813)
§6.10.4. Univention Active Directory Connector
The underlying library for AD-Member mode has been updated, fixing a locale issue (Bug 36280, Bug 36278).
The package univention-showload is no longer needed and maintained by Univention. The package can be manually removed (Bug 35138).
The packages for the deprecated system roles mobile client and managed client have been removed (Bug 31751).
The web browser firefox is now shipped as 64 bit binary on the amd64 platform. Previously it was always shipped as 32 bit application (Bug 35266).
The web browser firefox was updated to version 31.2 ESR. (Bug 35702, Bug 36374).
The legacy Debian package firefox has been replaced by the packages firefox-en and firefox-de since quite some time. During update to UCS 4.0 it will automatically get replaced by firefox-en. If desired the German version can be installed instead either before or after the update (Bug 36453).
An old, unused scalix directory has been removed from the PATH environment variable in the default profile (Bug 32628).
The deprecated package php5-suhosin will be purged during the update (Bug 35203).
Support for LanMan hashes has been removed in the Univention Directory Manager Users module (Bug 32584).
During the update the package console-tools is replaced with kbd (Bug 36224).
During the join of DC backup and slave systems all dns/forwarder* Univention Configuration Registry settings from the DC master will be copied to the joining system (Bug 36245).
The syntax check for jpeg images has been fixed in Univention Directory Manager (Bug 36304).
The keyboard layout is now configured with the Univention Configuration Registry variable xorg/keyboard/options/XkbModel, xorg/keyboard/options/XkbLayout and xorg/keyboard/options/XkbVariant. The old Univention Configuration Registry variable locale/keymap has been removed (Bug 35709).
The package ocfs2-tools has been updated to 1.6.4-3 (Bug 36377).
The KDE design has been adapted for UCS 4.0 (Bug 35936).
The xrdp App has been updated to version 0.8.0 with better rdp and linux terminal server support (Bug 35885).
Several packages are no longer in the maintained packages repository. If these packages are installed before the update, they will be removed during the update (i.a. gimp, k3b, kdepim, mplayer, krdc, krfb, kontact and nautilus, Bug 36050)
kdm is not used as the display manager for graphical login. The PAM configuration was updated to reflect this change (Bug 35266, Bug 36743)
§Literaturverzeichnis
[ext-doc-uvmm] Univention GmbH. 2014. Extended virtualization documentation. https://docs.software-univention.de/uvmm-4.0.html.
[ucs-uvmm-profile] Univention GmbH. 2014. UCS manual - Virtualization - Profiles. https://docs.software-univention.de/manual-4.0.html#uvmm::profile::network.
[ucs-performance-guide] Univention GmbH. 2014. UCS performance guide. https://docs.software-univention.de/performance-guide-4.0.html.

References: §2

§2

§2

§2

§3

§5

§5

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6