UCS 3.3 Release Notes

Release notes for the installation and update of Univention Corporate Server (UCS) 3.3


Table of Contents

1. Univention Corporate Server (UCS) 3.3
2. Recommended update order for environments with more than one UCS server
3. Preparation of update
4. Postprocessing of the update
5. Further notes on selected packages
5.1. Physical Address Extension
5.2. Collection of usage statistics when using the free-for-personal-use version
5.3. UEFI installation DVD
5.4. Scope of security support for WebKit, Konqueror and QtWebKit
5.5. Recommended browsers for the access to Univention Management Console
6. Changelog
6.1. General
6.2. Basic system services
6.2.1. Linux kernel and firmware packages
6.2.2. Important package upgrades
6.2.3. Univention Configuration Registry
6.3. Software deployment
6.4. System services
6.4.1. DHCP
6.4.2. SSL
6.5. Virtualisation
6.5.1. Xen
6.5.2. Libvirt
6.6. Samba
6.7. Univention Active Directory Connector
6.8. Other changes

§Chapter 1. Univention Corporate Server (UCS) 3.3

The third minor release for Univention Corporate Server (UCS) 3 is now available in the form of Univention Corporate Server 3.3. An overview of the most important changes:

  • The Linux kernel has been updated to version 3.16. This includes several security updates as well as new and updated drivers for better hardware support.

  • Samba has been updated to version 4.3.7. Besides many detail improvements, Samba 4.3 provides support for SMB 3.1.1, which was introduced by Microsoft with Windows 10 and provides security improvements and more features.

  • Many system services have been updated such as the DHCP server, the Xen hypervisor or the SQL servers MySQL and PostgreSQL.

  • Several system libraries have been upgraded among others the GNU C library, OpenSSL or PHP5.

§Chapter 2. Recommended update order for environments with more than one UCS server

In environments with more than one UCS system, the update order of the UCS systems must be borne in mind:

The authoritative version of the LDAP directory service is maintained on the master domain controller and replicated on all the remaining LDAP servers of the UCS domain. As changes to the LDAP schemes can occur during release updates, the master domain controller must always be the first system to be updated during a release update.

It is generally advisable to update all UCS systems in one maintenance window whenever possible.

§Chapter 3. Preparation of update

It must be checked whether sufficient disk space is available. A standard installation requires a minimum of 6 GB of disk space. Depending on the scope of the existing installation, the update will require at least another 1 GB of disk space for the downloading and installation of the packages.

For the update, a login should be performed on the system's local console as user root, and the update should be initiated there. Alternatively, the update can be conducted using Univention Management Console.

Remote updating via SSH is not recommended as this may result in the update procedure being cancelled, e.g., if the network connection is interrupted. In consequence, this can affect the system severely. If updating should occur over a network connection nevertheless, it must be verified that the update continues despite disconnection from the network. This can be done, e.g., using the tools screen and at. These tools are installed on all system roles by default.

It is possible to skip the upgrade to UCS 3.3. If the system should be upgraded directly from UCS 3.2 to UCS 4, the Univention Configuration Registry variable update33/skip/ucs3.3 has to be set to true.

§Chapter 4. Postprocessing of the update

The maintained Java version in UCS 3.3 is OpenJDK 7. If OpenJDK 6 is installed, the upgrade process tries to replace it with OpenJDK 7. If the automatic replacement fails, it has do be done manually. The automatic migration can be skipped by setting the Univention Configuration Registry variable update33/skip/openjdk7 to true before the update.

PostgreSQL 9.1 is delivered with UCS 3.3. Security Updates for PostgreSQL 8.4 won't be provided with UCS 3.3. The migration from PostgreSQL 8.4 to PostgreSQL 9.1 should be done after the migration to UCS 3.3. See SDB 1292 for more details.

Following the update, new or updated join scripts need to be executed. This can be done in two ways: Either using the UMC module Domain join or by running the command univention-run-join-scripts as user root.

Subsequently the UCS system needs to be restarted.

§Chapter 5. Further notes on selected packages

§5.1. Physical Address Extension

The Linux kernel was updated to version 3.16.7-ckt25. 32 bit systems without PAE support (physical address extension) are no longer supported.

§5.2. Collection of usage statistics when using the free-for-personal-use version

Anonymous usage statistics on the use of Univention Management Console are collected when using the free for personal use version of UCS (which is generally used for evaluating UCS). The modules opened are logged in an instance of the web traffic analysis tool Piwik. This makes it possible for Univention to tailor the development of Univention Management Console better to customer needs and carry out usability improvements.

This logging is only performed when the free-for-personal-use license is used. The license status can be verified by clicking on the cog symbol in the top right corner of the Univention Management Console and selecting License information. If Free for personal use edition is listed under License type, this version is in use. When a regular UCS license is used, no usage statistics are collected.

Independent of the license used, the statistics generation can be deactivated by setting the Univention Configuration Registry variable umc/web/piwik to false.

§5.3. UEFI installation DVD

In addition to the standard installation DVD there is also a medium with support for the Unified Extensible Firmware Interface standard (UEFI) available for the amd64 architecture.

It must be used instead of the standard DVD on systems which only support a UEFI boot.

§5.4. Scope of security support for WebKit, Konqueror and QtWebKit

WebKit, Konqueror and QtWebKit are shipped in the maintained branch of the UCS repository, but not covered with security support. WebKit is primarily used for displaying HTML help pages etc. Firefox should be used as web browser.

§5.5. Recommended browsers for the access to Univention Management Console

Univention Management Console uses numerous JavaScript and CSS functions to display the web interface. Cookies need to be permitted in the browser. The following browsers are recommended:

  • Chrome as of version 14

  • Firefox as of version 10

  • Internet Explorer as of version 9

  • Safari (on the iPad 2)

Users with older browsers may experience display or performance problems.

§Chapter 6. Changelog

Listed are the changes since UCS 3.2-8:

§6.1. General

  • The codename for UCS 3.3 is Osterholz (Bug 40833).

§6.2. Basic system services

§6.2.1. Linux kernel and firmware packages

  • The Linux kernel has been updated to 3.16. It provides better hardware support and many bugfixes (Bug 40687).
  • The open-vm-tools package has been updated to 9.4.6 in order to be compatible with the updated Linux kernel (Bug 40687).

§6.2.2. Important package upgrades

  • The GNU C Library package eglibc has been updated from 2.11 to 2.13 (Bug 40695).
  • The Linux Standard Base support package lsb has been updated to 3.2-28.1 (Bug 40695).
  • The package OpenSSH has been updated to 6.0 (Bug 40689).
  • The Apache Tomcat package tomcat6 has been upgraded to version 6.0.45 (Bug 40947).
  • The SQL server MySQL has been upgraded to version 5.5.40 (Bug 40691).
  • The PHP package php5 has been upgraded to version 5.4.45 (Bug 40693).
  • The maintained Java version in UCS 3.3 is OpenJDK 7. If OpenJDK 6 is installed, the upgrade process tries to replace it with OpenJDK 7. The migration can be skipped by setting the Univention Configuration Registry variable update33/skip/openjdk7 to true (Bug 40692).
  • The libxml2 library has been upgraded to version 2.8.0 (Bug 40696)
  • The package imagemagick has been upgraded to version 8:6.7.7.10-5+deb7u5 (Bug 41330)
  • The package graphicsmagick has been upgraded to version 1.3.16-1.1+deb7u1 (Bug 41330)
  • The package manager for RPM rpm has been upgraded to version 4.10.0 (Bug 40695).
  • The SQL server PostgreSQL 9.1 has been added. The migration from PostgreSQL 8.4 should be done after the upgrade to UCS 3.3 (Bug 40690).

§6.2.3. Univention Configuration Registry

  • The errata level has been reset to 0 (Bug 40764).

§6.3. Software deployment

  • The updater scripts preup.sh and postup.sh have been adapted to the needs of UCS 3.3 (Bug 40704, Bug 41068).

§6.4. System services

§6.4.1. DHCP

  • The DHCP package isc-dhcp has been upgraded to version 4.2.2 (Bug 40694)

§6.4.2. SSL

  • The openssl package has been upgraded to version 1.0.1e-2 (Bug 40688). Dependent packages have been rebuilt to use the new version.

§6.5. Virtualisation

§6.5.1. Xen

  • The Xen hypervisor and related support packages have been updated to version 4.1.6.1 (Bug 40697, Bug 39689).

§6.5.2. Libvirt

  • The libvirt management tool for virtualization environments has been updated to version 1.2.9 (Bug 32744).

§6.6. Samba

  • Samba has been upgraded to version 2:4.3.7 (Bug 40698).
  • ldb has been upgraded to version 2:1.1.25-1 (Bug 40698).
  • tdb has been upgraded to version 1.3.8-1 (Bug 40698).
  • tevent has been upgraded to version 0.9.26-1 (Bug 40698).
  • talloc has been upgraded to version 2.1.5-1 (Bug 40698).
  • univention-ldb-modules has been recompiled for the new ldb library version (Bug 40698).

§6.7. Univention Active Directory Connector

  • The Univention AD-Connector has been rebuilt with SSLv3 support (Bug 41079).

§6.8. Other changes

  • The package OpenOffice.org has been rebuilt without Java support (Bug 40692).