Source: http://docs.software-univention.de/release-notes-4.1-0-de.html
Timestamp: 2017-10-23 15:30:57+00:00

Document:
UCS 4.1-0 Release Notes
Release Notes für die Inbetriebnahme und Aktualisierung von Univention Corporate Server (UCS) 4.1-0
5.4. Verfahren für maintained und unmaintained-Pakete
6.3.3. Other system services
6.5.4. Modules for system settings / setup wizard
6.5.5. Computers module
6.5.6. Policies
6.6.1. Software deployment command line tools
6.8.4. Kerberos
6.8.5. SSL
6.8.6. Apache
6.8.7. PAM / Local group cache
6.8.8. Other services
6.11.2. Univention AD Takeover
Das Univention App Center integriert die Containertechnologie Docker. Mittels Docker lassen sich Apps voneinander getrennt und gekapselt betreiben. Dadurch werden die Sicherheit der UCS Umgebung erhöht und die Abhängigkeiten der Apps zu anderen Software-Bibliotheken reduziert. Die Integration von Docker ist für die Benutzer transparent. Das App Center führt die Inbetriebnahme und Konfiguration der Docker-Container automatisch durch.
Die Usability im Univention App Center wurde weiter verbessert. Apps werden nun übersichtlicher dargestellt. Die Detailseiten der Apps wurden aufgeräumt und um ein Rating in den Kategorien Vendor Supported, Popularity's Award und Editor's Award ergänzt. Die Einteilung basiert auf Daten wie zum Beispiel der Installationsbasis der Apps oder Wartungsverhalten der App Anbieter. Dadurch werden Transparenz und Vergleichbarkeit der Apps untereinander gesteigert.
Single-Sign-On via SAML ist ab UCS 4.1 Produktbestandteil und arbeitet Out of the box mit dem UCS-Managementsystem. Einmal angemeldet kann ohne Neuanmeldung zwischen Web-Anwendungen gewechselt werden.
Benutzer können über den neuen Self Service selbstständig ihr Passwort ändern oder im Fall eines vergessenen Passworts dies neu setzen lassen. Dafür können vorab E-Mailadressen oder Mobilfunknummern hinterlegt werden, an die dann ein entsprechendes Token verschickt wird. Mit dem Token kann ein neues Passwort gesetzt werden.
Der Linux Kernel wurde auf den letzten stabilen 4.1er Longterm-Kernel aktualisiert. Dieser beinhaltet diverse Sicherheitsaktualisierungen sowie neuere und aktualisierte Treiber für eine verbesserte Hardware-Unterstützung.
Samba wurde auf Version 4.3.1 aktualisiert. Neben sehr vielen Detailverbesserungen bietet Samba 4.3 Unterstützung für SMB 3.1.1, welches Microsoft mit Windows 10 eingeführt hat und das eine höhere Sicherheit und mehr Funktionen bietet.
Sofern Applikationen aus dem App Center installiert sind, ist das Update erst dann möglich, wenn alle lokal installierten Applikationen im App Center verfügbar sind. Einige Applikationen werden beim Update ebenfalls auf neuere Versionen aktualisiert. Sollte eine Applikation noch nicht für UCS 4.1 verfügbar sein, kann der Zeitpunkt der Veröffentlichung beim Applikationsanbieter nachgefragt werden.
Einige Komponenten sind entfernt worden und werden mit UCS 4.1 nicht mehr ausgeliefert:
PostgreSQL-8.4 wurde in UCS 4.1 entfernt. Die Daten müssen von Hand in eine neuere Version migriert werden. Das Vorgehen ist in SDB 1292 beschrieben.
Die App SAML identity provider gehört nun zum Produktumfang von UCS 4.1. Während des Updates auf UCS 4.1 wird der SAML identity provider automatisch konfiguriert. Wurde die App unter UCS 4.0 genutzt, müssen die Einstellungen der benutzten Service Provider aktualisiert werden. Insbesondere müssen auf den Service Providern neue Zertifikate und Metadaten verfügbar gemacht werden, um die Funktionalität wieder herzustellen.
Diese Protokollierung erfolgt nur bei Verwendung der UCS Core Edition. Der Lizenzstatus kann überprüft werden durch den Eintrag Lizenz -﻿> Lizenzinformation des Benutzermenüs in der rechten, oberen Ecke von Univention Management Console. Steht hier unter License type der Eintrag UCS Core Edition wird eine solche Edition verwendet. Bei Einsatz einer regulären UCS-Lizenz erfolgt keine Teilnahme an der Nutzungsstatistik.
§5.4. Verfahren für maintained und unmaintained-Pakete
Mit UCS 4.1 wurde das Verfahren für maintained und unmaintained-Pakete geändert.
Die Installations-DVD beinhaltet nur noch die Pakete, die für die Installation eines neuen UCS-Systems mit allen Komponenten, die von Univention bereitgestellt werden. Frühere DVDs enthielten auch alle anderen maintained-Pakete. Diese wurden entfernt, um die Größe für den Download zu reduzieren.
Die vollständige Menge aller maintained-Pakete wird über die Update DVD bereitgestellt. Diese kann benutzt werden, um ein lokales Repository zu aktualisieren.
Alle Pakete (maintained und unmaintained) sind auch online über https://updates.software-univention.de/ verfügbar.
Mit dieser Änderung ändert sich auch die Definition der maintained-Pakete: maintained ist nun auf der Basis der Quellpakete definiert, während es früher auf einer Untermenge der Binärpakete definiert war. Diese Änderung kann zu einer erhöhten Nutzung von Speicherplatz auf einem lokalen Repository-Server führen, da maintained nun mehr Pakete enthält als in früheren Releases.
Die Changelogs mit den detaillierten Änderungsinformationen werden nur in Englisch gepflegt. Aufgeführt sind die Änderungen seit UCS 4.0-4:
All packages have been adapted to UCS 4.1 (Bug 39729).
The codename for UCS 4.1 has been set to Vahr (Bug 39223).
The package univention-container-role-common has been added. It is used to strip down the base of installed packages in a Docker image (Bug 38283).
The errata level is reset during the upgrade to UCS 4.1 (Bug 39312).
The default inode density for partitions smaller than 4TB has been increased from 1 inode per 16KiB to 1 inode per 8KiB. This adjustment should avoid running out of inodes on system volumes. This only affects creation of new filesystem volumes (Bug 39432).
The Linux kernel has been updated to 4.1.12 (Bug 38873, Bug 38872).
The boot menu on the installation DVD has been improved. The DHCP request can now be skipped directly (Bug 39554).
The network registration is now skipped in the init script univention-network-common if UCS is running in a Docker container because the network registration for this mode is implemented in the init script univention-docker-container-mode (Bug 38365).
univention-firewall now creates port forwarding rules for services in Docker containers (Bug 38307).
Prevent an error when logging into a docker container without network interface (Bug 38861).
OpenLDAP has been updated to version 2.4.42 (Bug 38876).
The directory logger and the ldap_extension listener module now restart the OpenLDAP server only if it was running (Bug 39683).
The OpenLDAP server might be started multiple times during the upgrade. This is no longer a problem for the OpenLDAP package scripts (Bug 39683).
The graceful-restart of the OpenLDAP init script has been adjusted to reduce the grace time (Bug 39719).
The group access for the LDAPI socket interface has been removed (Bug 39811).
The permissions for GSSAPI SASL authentication have been fixed (Bug 29482, Bug 39877).
The hosts can now modify their own operatingSystem and operatingSystemVersion attributes (Bug 39915).
Support for logging in with the primary email address at UMC has been added (Bug 38528).
Unmovable objects are no longer shown as movable (Bug 20439).
All UMC cookies are now restricted to the path /univention-management-console/. Therefore, the entry point /umcp/ has been moved to /univention-management-console/ (Bug 38820).
The session and username cookie are now suffixed with the port to allow multiple parallel UMC session on the same host (Bug 38344).
A service entry for Univention Management Console has been added and the univention-management-console-web-server join script adds this service automatically to the LDAP host entry (Bug 39553).
The Univention Management Console login now supports authentication via SAML (Bug 31943, Bug 39549, Bug 39552).
The dropdown menu to switch the Univention Management Console uses the SAML single-sign-on process now. The previously used UMC single-sign-on implementation has been replaced with SAML (Bug 39227).
The dependency of univention-dojo-dev has changed to OpenJDK 7 (Bug 39572).
The integration of the browser history into UMC has been improved and added to UDM modules (Bug 39033).
The Univention Management Console login is now extensible to support authentication via a one time password (Bug 39611).
The exception SystemExit is now caught by the UMC server and not shown as a traceback to the user (Bug 39031).
A memory leak in the UMC webserver has been fixed which could occur when a SSL communication between UMC webserver and UMC server was not possible (Bug 38402).
The UMC PAM configuration has been extended. It is now possible to integrate additional services via PAM such as multi factor authentication modules (Bug 39612).
The App Center is now able to install docker based apps. These apps are installed in a small container (minimal UCS) within the host system (Bug 38887, Bug 39185, Bug 39258, Bug 39374, Bug 39331, Bug 39184, Bug 39183, Bug 39196, Bug 39496, Bug 39417, Bug 39330, Bug 39192, Bug 39467, Bug 39462, Bug 39629, Bug 39204, Bug 39189, Bug 39587, Bug 39189, Bug 39660, Bug 39434, Bug 39199, Bug 39820, Bug 39822, Bug 39716).
The variable UCSOverviewCategory now accepts the value None in which case any UCR variable once registered will be removed (Bug 39718).
The source package has been renamed to univention-appcenter to reflect the fact that the UMC module is a frontend for the Univention App Center (Bug 39585).
The design of the UMC App Center module has been adjusted, and some usability aspects have been improved (Bug 38894, Bug 39653, Bug 39665, Bug 39651, Bug 39835, Bug 39668).
App logos must be in the SVG format from UCS 4.1 on. Logos are referenced in the INI or META files as Logo and LogoDetailPage where the latter optional entry may define a different logo which is displayed in the app detail view (Bug 39525, Bug 39656).
The property Screenshot has been replaced with the property Thumbnails which allows a comma separated list of pictures or youtube URIs (Bug 39654, Bug 39524).
Apps can be rated. This rating is shown on the detail page of an App (Bug 38891).
Every time an app is opened from the Gallery, the session is refreshed silently to prevent logouts (Bug 39655).
The App Center now checks a digital signature of the index of app meta files (Bug 39591).
The global App Center now only suggests app updates on remote hosts when that's UCS version matches the local version (Bug 39912).
The searched keyword in the App Center resets if the category gets changed (Bug 39652).
§6.5.4. Modules for system settings / setup wizard
It is now possible to to black list the page for selecting the system role and use a pre-configured role value instead (Bug 38315).
The System Setup wizard now can have a configurable domain while the hostname itself is fixed. This is needed for Docker based apps (Bug 38275, Bug 38154).
During the initial system setup, the restart of the webserver is no longer disabled. This is needed for Docker based apps (Bug 39476).
§6.5.5. Computers module
The UDM attributes operatingSystem and operatingSystemVersion can now be set for domain controllers and member servers (Bug 39915).
§6.5.6. Policies
When adding an object without policies referenced, no traceback occurs anymore (Bug 37667).
Various modules are now able to handle python-psutil API changes (Bug 39322, Bug 39323).
The size of the UCS installation DVD has been reduced by removing all packages not strictly required for installation from the DVD. All maintained packages are still available online or through the update DVD (Bug 38913).
The updater scripts preup.sh and postup.sh have been adapted to the needs of UCS 4.1 (Bug 39271).
The UDM attributes operatingSystem and operatingSystemVersion of an UCS server are now set during the upgrade (Bug 39915).
The updater now uses the protocol HTTPS to access the Univention Software Repository at https://updates.software-univention.de/ by default (Bug 39306).
The updater now uses the proxy defined in the Univention Configuration Registry variable proxy/https for HTTPS connections. If proxy/https is not defined, the fallback proxy/http is used (Bug 39922).
The Univention Configuration Registry variable proxy/address, proxy/port, proxy/username and proxy/password are no longer used to configure the package toolkit apt. Please use the Univention Configuration Registry variable proxy/http or proxy/https instead (Bug 39922).
The updater now uses the license UUID (Univention Configuration Registry variable license/uuid) to access the Univention Software Repository at https://updates.software-univention.de/ by default (Bug 39305).
The updater now skips downloading translation files and differential Packages files (Bug 28022).
The updater preup.sh script now checks if the DC master has already been updated (Bug 37260).
The fatal error message in univention-upgrade now references the logfile /var/log/univention/updater.log for further details (Bug 31006).
univention-upgrade now uses --enable-app-updates by default (Bug 39082).
§6.6.1. Software deployment command line tools
The mount point for CD-ROM images in univention-updater and univention-repository-update has been fixed (Bug 36721).
The function is_ucr_true has been added to the package shell-univention-lib (Bug 27701).
The package OpenSSL has been updated to version 1.0.2d (Bug 39500).
The package cURL treated warning alerts as fatal during the TLS handshake, which prevented connecting to some https:// servers using SNI. This has been fixed (Bug 39603).
The SAML identity provider app has been integrated into UCS (Bug 38881, Bug 39468).
The package univention-saml is installed on DC Master and DC Backup systems automatically during the UCS 4.1 upgrade (Bug 39313).
Single-sign-on via SAML 2.0 is now possible with Univention Management Console (Bug 39171, Bug 39178, Bug 31943).
A download link for the public certificate of the identity provider has been added to the module (Bug 32786).
Every SAML identity provider registers its default IP address via DNS at the host record ucs-sso to provide a failover configuration. The name can be changed before joining the UCS system through the Univention Configuration Registry variable ucs/server/sso/fqdn (Bug 39386, Bug 39574, Bug 39399).
The SimpleSAMLphp certificate is now created in the joinscript instead of the postinst of the package (Bug 39255).
The SimpleSAMLphp files authsources.php and saml20-idp-hosted.php have been changed to a UCR multifile template (Bug 39250).
SimpleSAMLphp has been updated to version 1.13.2-1 (Bug 38982).
AssertionConsumerService is now a multi-value field (Bug 39015).
The ACL evaluation of SimpleSAMLphp has been fixed (Bug 38935).
Renaming of a service provider is now prevented as the user references weren't updated when doing so (Bug 38934).
Transmitting LDAP attributes from the identity provider is now possible and does not cause exceptions in SimpleSAMLphp anymore (Bug 38927).
The entityID of the identity provider is now configurable via the Univention Configuration Registry variable saml/idp/entityID (Bug 33912).
The SAML identity provider now uses a dedicated LDAP user to access the LDAP and a separate user is used to access SSO specific web-content by apache2 (Bug 38947).
The App Center module has been adapted to work with single-sign-on (Bug 39226).
The UMC server and LDAP server allow authentication with a SAML assertion via the packages pam-saml and cy2-saml (Bug 39315).
PHP syntax is now correctly escaped and validated when writing the simplesamlphp service provider configuration (Bug 38933).
The SAML join script has been moved from univention-saml-schema to univention-saml (Bug 39472).
A required password change, expired passwords, locked and disabled accounts are detected by the SAML login and the user is informed, while login is denied (Bug 39181).
stunnel4 has been updated to 5.18, and now supports certificate validation for the connected memcache instances (Bug 39479).
The default NameID identifier format for configured service providers is changed to urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified (Bug 39431).
The SAML schema package now restarts the OpenLDAP server only if it was running (Bug 39683).
Display problems for the Internet Explorer compatibility mode have been corrected (Bug 39850).
The user can now change or reset her/his password by using the password self-service (Bug 39597).
Authentication (and thus submitting) has been disabled by default on port 25. Set Univention Configuration Registry variable mail/postfix/mastercf/options/smtp/smtpd_sasl_auth_enable=yes to enable the old behavior (Bug 39021).
The Dovecot Managesieve service is now also available via IPv6 (Bug 39702).
A problem with postfix' start script /etc/init.d/postfix has been fixed that could lead to the inability to start/stop postfix in docker containers (Bug 39542).
When installing univention-mail-postfix for the first time, 512 bit DH parameters for Postfix are now generated immediately and 2048 bit DH parameters are scheduled by the join script to be generated on the next day (Bug 39482).
§6.8.4. Kerberos
The dependency to univention-home-mounter has been removed from the Kerberos rsh daemon (Bug 39490).
§6.8.5. SSL
univention-ssl can now create certificates for FQDNs longer than 64 characters. The OpenSSL extension Subject Alternative Name is used in such a case (Bug 38859).
univention-apache now ships expandable VirtualHost configuration files (Bug 38807).
The dependency on univention-home-mounter has been changed to a recommendation in the univention-pam package (Bug 39490).
univention-postgresql has been split into multiple packages, one for each PostgreSQL version (Bug 39595). univention-bacula does not create the PostgreSQL configuration files for not-installed versions anymore (Bug 39595). univention-pkgdb does not create the PostgreSQL configuration files for not-installed versions anymore (Bug 39595).
UVMM profiles for Windows 10 have been added (Bug 39335).
The description of a virtual machine is dynamically displayed as a grid column (Bug 38676).
The user can now select the MAC address inside the interface grid. (Bug 33546).
The package qemu has been updated and has been re-compiled with support for Xen disabled. The package libvirt has also been re-compiled with support for Xen disabled (Bug 39685).
The package docker.io has been updated to 1.6 (Bug 39350).
OverlayFS has been configured as the Docker storage driver (Bug 39412, Bug 39418).
The packages univention-docker-container-mode and univention-appliance-docker-container have been added. These packages help to run UCS in a Docker container (Bug 39331, Bug 38260).
The function ucs_registerLDAPExtension from package shell-univention-lib now supports the options packagename and packageversion (Bug 38205).
When joining a UCS domain, Docker containers do not register their IP and MAC addresses in the computer object (Bug 38437).
UCR can now modify files on a bind-mounted filesystem in a Docker container (Bug 38011).
The Heimdal Kerberos installation does not fail anymore in a Docker container (Bug 38295).
No keyboard or console font setup is done inside a Docker container (Bug 38763).
A docker repository is now hosted on docker.software-univention.de (Bug 39188).
A docker init script has been added which properly stops and restarts running containers (Bug 39474).
Docker images running UCS in container mode now update their IP addresses in LDAP if one is already registered there. This is useful because Docker dynamically assigns IP addresses during container restarts (Bug 38334).
Docker images running UCS in container mode now try to register the IP also with a consul and etcd service running on the Docker host (Bug 38331).
The Docker log file is now readable only by root and the docker process (Bug 39494).
The App Center checks the digital checksum of docker images hosted on docker.software-univention.de before downloading them. The integrity of the container maintainer scripts are verified in this manner as well (Bug 39194).
The time zone in Docker containers is now set to the same as the host (Bug 39483).
A base image for UCS hosted apps has been created and uploaded to docker.software-univention.de (Bug 39187).
Samba has been updated to version 4.3.1 (Bug 38874).
The default domain and forest function level for new installations is now 2008 R2 (Bug 38800).
The Univention Configuration Registry variable samba/register/exclude/interfaces has been added. The IP addresses of theses network interfaces are not registered automatically in DNS. By default the variable is set to docker0 (Bug 39466).
The Univention Configuration Registry variable samba/max/protocol doesn't get set any longer for new installations. Additionally, if it was set to the default "SMB2" it will get unset as well during updates. The purpose of this change is to give customers the highest protocol level considered stable by the Samba defaults. Currently this is SMB3_11. (Bug 32939).
The IPC$ share is not explicitly configured any longer in the default configuration where samba4/service/smb is s3fs. This change avoids a lot of unnecessary warning messages from samba (Bug 29227).
The Samba package now restarts the OpenLDAP server only if it was running (Bug 39683).
The in place upgrade of Samba 3/NT4 to Samba 4/AD has been fixed (Bug 39932, Bug 37646).
§6.11.2. Univention AD Takeover
The FSMO roles domaindnsmaster and forestdnsmaster are now seized during the takeover (Bug 39222).
Installation of Univention AD Takover now also installs fping (Bug 39723).
Asterisk has been updated to 11.13.1. It provides many bugfixes and fixes several vulnerabilities (Bug 37738, Bug 39285)
univention-join now correctly checks for the existence of nscd. This is needed in a minimal environment (Bug 38662).
nscd terminates its children when stopping (Bug 38135).
The packages for the default settings/packages Univention Directory Manager objects have been updated (Bug 32443).
Several package dependencies in Docker related base packages have been changed (Bug 39410).
The response handling in the univention.lib.umc_connection.UMCConnection library has been improved (Bug 39599).
The iceweasel package has been put into unmaintained status, so it will not be considered any longer for security updates. It has not been used anyway as firefox-en and firefox-de are installed e.g. for the system setup (Bug 38281).

References: §5

§6

§6

§6

§6

§6

§6

§6