Mit Univention Corporate Server 4.0-2 steht das zweite Point-Release für Univention Corporate Server (UCS) 4.0 zur Verfügung. Es umfasst diverse Detailverbesserungen und Fehlerkorrekturen. Die wichtigsten Änderungen im Überblick:

Die Free for personal Use Lizenz wurde durch die UCS Core Edition Lizenz ersetzt. Dadurch kann UCS auch im kommerziellen Einsatz kostenfrei eingesetzt werden. Das Upgrade der Lizenz ist in SDB 1324 beschrieben. Mehr Informationen zur UCS Core Edition finden sich unter https://www.univention.de/produkte/preise/.
Die Container-Virtualisierung Docker wurde zu UCS hinzugefügt. Dadurch können auf einem UCS-System Docker-Container gestartet werden. Es stehen auch erste Docker Images von UCS zur Verfügung. Weitere Informationen dazu unter http://wiki.univention.de/index.php?title=Docker.
Für die Erstellungen von Apps gibt es jetzt speziell einen eigenen Leitfaden.
Nach der Installation einer App auf einem entfernten System wird diese nun automatisch über Join Skripte konfiguriert.
Es gab zahlreiche Verbesserungen in Design und Usability der Univention Management Console.
Die automatische Profil-basierte UCS Installation über das Netzwerk wurde hinzugefügt.
Die Active Directory Kompatibilität wurde verbessert. So ist nun der Domänenbeitritt von Windows 2008 R2 Foundation Servern als Memberserver möglich. Zudem wurde ein Problem in der SID Auflösung in Zusammenhang mit NetApp Storage Systemen behoben.
Beim Web-Server Apache und Mail-Server Postfix werden zusätzliche Einstellungen bezüglich der Verschlüsselung und anderer Sicherheitseinstellungen unterstützt. Des Weiteren werden alte Verschlüsselungsverfahren standardmäßig nicht mehr aktiviert.

§Kapitel 2. Hinweise zum Update

Während der Aktualisierung kann es zu Ausfällen von Diensten innerhalb der Domäne kommen. Aus diesem Grund sollte das Update innerhalb eines Wartungsfensters erfolgen. Grundsätzlich wird empfohlen das Update zunächst in einer Testumgebung einzuspielen und zu testen. Die Testumgebung sollte dabei identisch zur Produktivumgebung sein. Je nach Systemgeschwindigkeit, Netzwerkanbindung und installierter Software kann das Update zwischen 20 Minuten und mehreren Stunden dauern.

§2.1. Empfohlene Update-Reihenfolge

In Umgebungen mit mehr als einem UCS-System muss die Update-Reihenfolge der UCS-Systeme beachtet werden:

Auf dem Domänencontroller Master wird die maßgebliche (authoritative) Version des LDAP-Verzeichnisdienstes vorgehalten, die an alle übrigen LDAP-Server der UCS-Domäne repliziert wird. Da bei Release-Updates Veränderungen an den LDAP-Schemata auftreten können, muss der Domänencontroller Master bei einem Release-Update immer als erstes System aktualisiert werden.

§2.2. Univention App Center

Sofern Applikationen aus dem App Center installiert sind, ist das Update erst dann möglich, wenn alle lokal installierten Applikationen im App Center verfügbar sind. Einige Applikationen werden beim Update ebenfalls auf neuere Versionen aktualisiert. Sollte eine Applikation noch nicht für UCS 4.0 verfügbar sein, kann der Zeitpunkt der Veröffentlichung beim Applikationshersteller nachgefragt werden.

§2.3. UCS-Installations-DVDs nur noch als 64-Bit-Variante

UCS-Installations-DVSs werden ab UCS 4 nur noch für 64-Bit-Archtitekturen bereitgestellt. Vorhandene 32-Bit UCS 3 Systeme können weiterhin über das Online Repository oder über Update DVDs auf UCS 4 aktualisiert werden. Die 32-Bit-Archtitektur wird für die gesamte UCS 4 Maintenance noch unterstützt.

§Kapitel 3. Vorbereitung des Updates

Es sollte geprüft werden, ob ausreichend Festplattenplatz verfügbar ist. Eine Standard-Installation benötigt min. 6 GB Speicherplatz. Das Update benötigt je nach Umfang der vorhanden Installation ungefähr 2 GB weiteren Speicherplatz zum Herunterladen und Installieren der Pakete.

Für das Update sollte eine Anmeldung auf der lokalen Konsole des Systems mit dem Benutzer root durchgeführt und das Update dort gestartet werden. Alternativ kann das Update über Univention Management Console durchgeführt werden.

Eine Remote-Aktualisierung über SSH wird nicht empfohlen, da dies beispielsweise bei Unterbrechung der Netzverbindung zum Abbruch des Update-Vorgangs und zu einer Beeinträchtigung des Systems führen kann. Sollte dennoch eine Aktualisierung über eine Netzverbindung durchgeführt werden, ist sicherzustellen, dass das Update bei Unterbrechung der Netzverbindung trotzdem weiterläuft. Hierfür können beispielsweise die Tools screen oder at eingesetzt werden, die auf allen Systemrollen installiert sind.

§Kapitel 4. Nachbereitung des Updates

Nach dem Update müssen die neuen oder aktualisierten Join-Skripte ausgeführt werden. Dies kann auf zwei Wegen erfolgen: Entweder über das UMC-Modul Domänenbeitritt oder durch Aufruf des Befehls univention-run-join-scripts als Benutzer root.

Anschließend muss das UCS-System neu gestartet werden.

§Kapitel 5. Hinweise zum Einsatz einzelner Pakete

§5.1. Netzwerkinstallation von UCS

Die Profil-basierte Netzwerkinstallation von UCS steht mit UCS 4.0-2 zur Verfügung. Genauere Informationen dazu befinden sich in [ext-doc-inst].

§5.2. Erfassung von Nutzungsstatistiken

Bei Verwendung der UCS Core Edition-Version von UCS (die in der Regel für Evaluationen von UCS herangezogen wird) werden anonyme Nutzungsstatistiken zur Verwendung von Univention Management Console erzeugt. Die aufgerufenen Module werden dabei von einer Instanz des Web-Traffic-Analyse-Tools Piwik protokolliert. Dies ermöglicht es Univention die Entwicklung von Univention Management Console besser auf das Kundeninteresse zuzuschneiden und Usability-Verbesserungen vorzunehmen.

Diese Protokollierung erfolgt nur bei Verwendung der UCS Core Edition. Der Lizenzstatus kann überprüft werden durch den Eintrag Lizenz -> Lizenzinformation des Benutzermenüs in der rechten, oberen Ecke von Univention Management Console. Steht hier unter License type UCS Core Edition wird eine solche Version verwendet. Bei Einsatz einer regulären UCS-Lizenz erfolgt keine Teilnahme an der Nutzungsstatistik.

Die Protokollierung kann unabhängig von der verwendeten Lizenz durch Setzen der Univention Configuration Registry-Variable umc/web/piwik auf false deaktiviert werden.

§5.3. Umfang des Sicherheits-Supports von WebKit, Konqueror und QtWebKit

WebKit, Konqueror und QtWebKit werden in UCS im maintained-Zweig des Repositorys mitgeliefert, aber nicht durch Sicherheits-Updates unterstützt. WebKit wird vor allem für die Darstellung von HTML-Hilfeseiten u.ä. verwendet. Als Web-Browser sollte Firefox eingesetzt werden.

§5.4. Empfohlene Browser für den Zugriff auf Univention Management Console

Univention Management Console verwendet für die Darstellung der Web-Oberfläche zahlreiche JavaScript- und CSS-Funktionen. Cookies müssen im Browser zugelassen sein. Die folgenden Browser werden empfohlen:

Chrome ab Version 33
Firefox ab Version 24
Internet Explorer ab Version 9
Safari und Safari Mobile ab Version 7

Auf älteren Browsern können Darstellungs- oder Performanceprobleme auftreten.

§Kapitel 6. Changelog

Die Changelogs mit den detaillierten Änderungsinformationen werden nur in Englisch gepflegt. Aufgeführt sind die Änderungen seit UCS 4.0-1:

§6.1. General

All security updates issued for UCS 4.0-1 are included:
- binutils (CVE-2014-8484 CVE-2014-8485 CVE-2014-8501 CVE-2014-8502 CVE-2014-8503 CVE-2014-8504 CVE-2014-8737 CVE-2014-8738) (Bug 36983)
- cairo (CVE-2013-7439) (Bug 38250)
- ClamAV (CVE-2014-9050 CVE-2013-6497 CVE-2014-9328 CVE-2015-1461 CVE-2015-1462 CVE-2015-1463) (Bug 36966)
- Firefox (CVE-2015-0822 CVE-2015-0827 CVE-2015-0831 CVE-2015-0835 CVE-2015-0836 CVE-2015-0801 CVE-2015-0807 CVE-2015-0813 CVE-2015-0815 CVE-2015-0816 CVE-2015-0817 CVE-2015-0818) (Bug 37881 Bug 38179)
- FreeType (CVE-2014-9656 CVE-2014-9657 CVE-2014-9658 CVE-2014-9660 CVE-2014-9661 CVE-2014-9663 CVE-2014-9664 CVE-2014-9666 CVE-2014-9667 CVE-2014-9669 CVE-2014-9670 CVE-2014-9671 CVE-2014-9672 CVE-2014-9673 CVE-2014-9675) (Bug 37757)
- GnuPG (CVE-2015-1606 CVE-2014-3591 CVE-2015-0837) (Bug 37841)
- Iceweasel (CVE-2013-7439 CVE-2015-0801 CVE-2015-0807 CVE-2015-0813 CVE-2015-0815 CVE-2015-0816 CVE-2015-0817 CVE-2015-0818 CVE-2015-0822 CVE-2015-0827 CVE-2015-0831 CVE-2015-0835 CVE-2015-0836) (Bug 38271)
- krb5 (CVE-2014-5352 CVE-2014-9421 CVE-2014-9422 CVE-2014-9423) (Bug 37680)
- LibreOffice (CVE-2013-7439) (Bug 38250)
- libSDL1.2 (CVE-2013-7439) (Bug 38250)
- libX11 (CVE-2013-7439) (Bug 38250)
- libXext (CVE-2013-7439) (Bug 38250)
- libXfixes (CVE-2013-7439) (Bug 38250)
- libXi (CVE-2013-7439) (Bug 38250)
- libxml2 (CVE-2014-0191 CVE-2014-3660) (Bug 37745)
- libXrandr (CVE-2013-7439) (Bug 38250)
- libXrender (CVE-2013-7439) (Bug 38250)
- libXv (CVE-2013-7439) (Bug 38250)
- libXxi (CVE-2013-7439) (Bug 38250)
- ntp (CVE-2014-9297) (Bug 37746)
- OpenLDAP (CVE-2015-1545 CVE-2015-1546) (Bug 37729)
- OpenSSL (CVE-2015-0209 CVE-2015-0286 CVE-2015-0287 CVE-2015-0288 CVE-2015-0289 CVE-2015-0292) (Bug 37960)
- Open-VM-tools (CVE-2013-7439) (Bug 38250)
- PostgreSQL-9.1 (CVE-2015-0241 CVE-2015-0243 CVE-2015-0244 CVE-2014-8161) (Bug 37701)
- samba (CVE-2015-0240) (Bug 37735)
- sudo (CVE-2014-0106 CVE-2014-9680) (Bug 37852)
- TeXLive-bin (CVE-2013-7439) (Bug 38250)
- TightVNC (CVE-2013-7439) (Bug 38250)
- Wine-gecko (CVE-2013-7439) (Bug 38250)
- xserver-xorg-video-vmware (CVE-2013-7439) (Bug 38250)

§6.2. Univention Installer

The Univention Net Installer has been adapted to allow profile based installations of UCS-4.0-1 (Bug 35537).

§6.3. Basic system services

§6.3.1. Univention Configuration Registry

The file name for temporary files created by UCR commit now start with a dot (.) to hide them by default (Bug 37819).
Fixed a race condition in the univention-ldapsearch wrapper, which prevented proper error detection (Bug 37631).

§6.3.2. Boot Loader

Fixed a compilation error in the memtest86+ binary which resulted in the memory test 7 Random number sequence to always fail (Bug 37638).

§6.4. Domain services

§6.4.1. OpenLDAP

Support for the UCS Core Edition license has been added. Every Free for personal use license can easily be migrated to the UCS Core Edition. Details can be found in the SDB 1324 (Bug 38107).
If a password has been changed via Samba 4, the account expiry setting was not always considered. This has been fixed (Bug 38060).

§6.4.1.1. LDAP schema changes

The LDAP attribute univentionSamba4pwdProperties (integer) has been added to the sambaDomain object class (Bug 28331).

§6.5. Univention Management Console

§6.5.1. Univention Management Console web interface

The version of the Dojo Toolkit has been updated from 1.10.2 to 1.10.4. Support for IE11 in the Dojo module dojo/uacss has been added (Bug 38225).
If host name or user name are too long for the menu labels in the header, their length is now trimmed and ... is shown. The positioning of the back to overview header button has been adjusted. The UMC background image has been adjusted. The default search button has been adjusted to be smaller and to only contain an icon instead of text. The UMC header menus have been adjusted in their positioning on small screens and they have been styled with icons. The style of modules and module headers has been slightly adjusted. Pop-up dialogues that need no verification now have a close icon. Notifications must now be closed via a close icon. The label for module buttons is now centred if there is enough space (Bug 37780).
An error prevented the execution of stopping virtual machines as well as reporting erroneous UMC behaviour. These can now be executed again (Bug 37892).
Changed the cursor to a pointer when hovering grid row actions (Bug 37197).
A help icon has been added to the login dialogue (Bug 37804).
SVG icon images had under specific circumstances display problems in Internet Explorer 11. For Internet Explorer, the icons are displayed now in the PNG format (Bug 38225).
Displaying of the UMC reload dialogue has been adjusted (Bug 37565).
The automatic selection of the first item in a list widget (e.g., in the installed system locales in language settings) has been removed (Bug 33199).
Methods for resetting UMC modules and renewing a session have been added Bug 37347).
Pass the required attribute to sub widgets of the ComplexInput widget (Bug 36539).
An animation has been added for opening and hiding modules (Bug 37899).
Update references to www.univention.de (Bug 37908).
The activation of UCS with a personalized license key as well as the import process of a new license file has been improved w.r.t. the usability (Bug 38132).
The UMC grid can now take care of cleaning up orphaned widget references that could lead to a growing memory consumption in the browser (particular in UVMM) (Bug 36615).
The Univention management console web server and the upload widgets can now handle uploading several files at once and are capable of drag and drop (Bug 38276).
Some label texts in the Services modules have been improved, and icons have been added for the module actions (Bug 36564).

§6.5.2. Univention Management Console server

The package python-notifier has been updated to version 0.9.7. This fixes a bug which could cause a UMC server crash in specific circumstances (Bug 37457).
A race condition during UMC session shutdown has been fixed, that could lead to a complete shutdown of the UMC server (Bug 37399).
Removing and subsequently adding extended attributes could lead to a UMC server crash. The attribute handling in the server has been improved (Bug 37447).
User preferences as well as favourite UMC modules could not be saved into the LDAP under specific circumstances. This behaviour has been adjusted (Bug 38222).
It is now possible to request a single-sign-on login token for localhost (Bug 37347).
The number of parallel and open request in the UMC webserver has been raised and can now be configured via the Univention Configuration Registry variable umc/http/maxthreads (Bug 37851).

§6.5.3. Univention App Center

After installing an app, all pending join scripts are called with the credentials of the currently logged-in user (Bug 36822).
After installing apps or software packages, UMC modules are now reset, the UMC session is renewed automatically, and a page reload is done only if really necessary (Bug 37347).
Add support for WebInterfacePortHTTP and HTTPS in the ini file of an app (Bug 35456).
Update references to www.univention.de (Bug 37908).
Conflicts between apps are now calculated based on actual installation, not only one of the involved packages (Bug 35661).
The process of loading license information from the LDAP has been improved to avoid idle times in UMC (Bug 37616).
Apps may now define a minimal UCS version below which the app may not be installed (Bug 38042).
Apache may now be restarted by packages during installation via the Package Management module (Bug 38446).

§6.5.4. Univention Directory Manager UMC modules and command line interface

Support for the UCS Core Edition license has been added. Every "Free for personal use" license can easily be migrated to the UCS Core Edition. Details can be found in the SDB 1324 (Bug 38103 and Bug 38104).
Remove an attribute formerly used by Univention Net Installer from various computer modules (Bug 37560).
Fix tracebacks due to incorrect checks whether an object exists (Bug 37119).
Creating a simple authentication account is now much faster (Bug 37607).
Adjust an error message of the PrinterURI syntax class (Bug 36711).
Prevent de-installation of essential packages when creating a slave/master/member-server packages policy (Bug 36539).
Replaced the term General by a more descriptive title in various UDM modules (Bug 36401).
Improved error message format (Bug 37740).
Don't create a pointer record if no forward zone could be determined when modifying a computer object (Bug 37504).
Repair --policies option of UDM command line tool (Bug 21585).
Added appropriate validation for the mail domain name. To restore the old behaviour it is possible to overwrite the syntax from the CLI: ucr set directory/manager/web/modules/mail/domain/properties/name/syntax='string' (Bug 34552).
DVS and support information has been removed from univention-license-check (Bug 38203).
Two attributes domainPasswordComplex and domainPasswordStoreCleartext have been added to the sambadomain settings module (Bug 28331).
Labels of multi value fields in UDM modules have been adjusted to be more consistent (Bug 32760).
The appearance of the search and advanced search button has been adjusted. Shortened the description for the Back to search and Save changes buttons to Back and Save (Bug 37780).
The module cache is cleared now with the internal registration mechanism (Bug 37347).
A pop-up notification about automatically set default values was displayed for values which were disabled by the selected options. This has been fixed (Bug 37711).
Fix format of error message in specific circumstances (Bug 36711).
Execute UDM requests again if an LDAP error occurs due to timeout problems (Bug 37740).
Policy labels are now correctly displayed with an edit link. Changes on a UDM object can now be saved by pressing 'Return' on the keyboard (Bug 36708).
Update a warning icon (Bug 36460).
DVS and support information has been removed from the license information dialogue (Bug 38203).

§6.5.5. Basic settings / Appliance mode

When joining a system into a domain, the Kerberos password is no longer logged into /var/log/univention/join.log (Bug 37489).
Fix the calculation of the CIDR when displaying network interface settings (Bug 37326).
The positioning of page icons on small screens has been optimized (Bug 37824).
Additional connection and setup information is now shown by displaying the file motd.setup before the system is fully configured (Bug 37129, Bug 38510).
Error handling during saving in the system setup modules has been improved (Bug 36843).
A warning is displayed during appliance mode when too few memory is available for installing UCS (Bug 36460).
The instructions how to access Univention Management Console for the first time has been enhanced (Bug 37804).
License agreement information can now be displayed during the setup wizard (Bug 37616).
The password description will now be hidden, as well, when the password field is hidden (e.g., during the installation) (Bug 38148).
The Univention Configuration Registry variable system/setup/boot/fields/blacklist has been extended to disabling the selection of particular server roles (Bug 38116).
A reload of Apache is now disabled during the complete configuration of a UCS appliance. This has been done in order to avoid access problems at the end of the wizard when accessing UMC via HTTPS (Bug 37771).
The city search widget has been improved w.r.t. its usability (Bug 37771).
The progress bar has been adjusted to reach 100%, its localization has been corrected to match the chosen one, and its output has been improved (Bug 35550).
Output written into /var/log/univention/setup.log is now regularly flushed (Bug 38293).
Fixed wrong URL for advanced UVMM network setup (Bug 38314).
Cleanup scripts will now be executed if setup-join.sh is called from the command line. All output is logged to STDOUT/STDERR (Bug 38332).
The setup script 05_role/10role has been speeded up. It creates hard-links instead of copying packages into the dpkg cache (Bug 38393).
Improved logging when running setup-join: run-parts now prints filenames (Bug 38332).

§6.5.6. License module

Support for the UCS Core Edition license has been added. Every Free for personal use license can easily be migrated to the UCS Core Edition. Details can be found in the SDB 1324 (Bug 38102).

§6.5.7. Process overview module

Prevent an error if the user of an process is unknown (Bug 33923).
Killing multiple processes at once now works properly (Bug 33193).
If a process is being killed that is not running anymore an error message is shown (Bug 25305).

§6.5.8. Software update module

Hide the Back button during upgrading the system (Bug 37741).
The dialogue showing the list of packages to be updated/installed in the Software update module is now limited in its maximum height. The styling for the updater dialogue has been slightly adjusted (Bug 37573).
A default time-out of 10 minutes was added to the updater, after which stalled HTTP connections are aborted (Bug 36044).
A confirmation dialogue is now prompted when the browser window is closed or the page is reloaded during an update process (Bug 37033).
univention-add-app now prevents the installation of apps on the wrong server role (Bug 32543).
A local repository created from the UCS-4.0-1 DVD was incorrectly copied to the location reserved for UCS-4.0-0 (Bug 38248).
The Packages files required for profile based installations are now generated locally (Bug 35537).

§6.5.9. Filesystem quota module

If the first configured LDAP server was not reachable, timeouts could occur during the login. This has been fixed in the script univention-user-quota (Bug 36805).
An error message about an unbound variable has been removed from the script univention-group-quota (Bug 37134).
The quota settings are now written to a cache directory by a listener module. The PAM script which sets the quota settings to the share uses this cache directory. This improves the login performance (Bug 36989).

§6.5.10. Univention Configuration Registry module

The width of the dialogue for editing Univention Configuration Registry variable has been enlarged (Bug 37742).
HTML entities in Univention Configuration Registry variable descriptions are now properly escaped (Bug 38036).

§6.5.11. Other modules

The rendering of the list view has been optimized (Bug 36569).

§6.6. Univention base libraries

If the first configured LDAP server was not reachable, timeouts could occur during the login. This has been fixed (Bug 36805).

§6.7. System services

§6.7.1. Mail services

The Univention Configuration Registry variable descriptions for mail/localmailboxsizelimit and mail/messagesizelimit have been updated as 0 does not implement unlimited as previously mentioned (Bug 38061).
Additional arguments for smtpd processes may now be added via Univention Configuration Registry variables. The given arguments are automatically added to the configuration file /etc/postfix/master.cf. The following UCR variable prefixes are currently supported:
- mail/postfix/mastercf/options/smtp/...
- mail/postfix/mastercf/options/smtps/...
(Bug 37442)
The first changes to the main.cf framework have been done for defining a custom restriction rule set via Univention Configuration Registry variables for Postfix' smtps port (465). There is currently no change in Postfix behaviour (Bug 38049).
Allow Postfix to receive client mails on submission port 587 (Bug 30043).
Exclude RC4 Cipher Suites from all TLS security levels (RFC 7465). Adds Univention Configuration Registry variables mail/postfix/tls/client/exclude_ciphers and mail/postfix/smtpd/tls/exclude_ciphers and sets them by default to RC4, aNULL (Bug 38043).
Allow to set TLS/SSL settings for server and client. Disables SSLv3 for fresh installs, except for receiving mails. Adds Univention Configuration Registry variables mail/postfix/smtpd/tls/*protocols and mail/postfix/tls/client/*protocols (Bug 38044).
Add options to check the mapping of IP addresses to FQDNs to fight spam. Adds Univention Configuration Registry variables mail/postfix/smtpd/restrictions/sender/require_reverse_dns and mail/postfix/smtpd/restrictions/sender/require_forward-confirmed_reverse_dns for weaker and stricter reverse DNS checking respectively (Bug 38292).

§6.7.2. Spam/virus detection and countermeasures

Remove references to ahbl.org DNSBL, which has ceased operation (Bug 37471).
ClamAV has been updated to version 0.98.6 (Bug 36966).

§6.7.3. Printing services

univention-printquota now copies the /etc/machine.secret file for LDAP lookups in the join script (Bug 36861).

§6.7.4. SSL

Fixed an endless loop when invalid values for certificates are supplied (Bug 38125).

§6.7.5. Proxy services

The web-proxy Squid now also uses the additional LDAP servers configured through the Univention Configuration Registry variable ldap/server/addition (Bug 37752).
Network interfaces other then ethX are now also added to the access control list (Bug 36623).
The Squid configuration can now be extended with custom ACLs via Univention Configuration Registry variables (Bug 37543).

§6.7.6. Apache

Kill and restart the apache process in the init script if a reload crashes the apache process (Bug 37792).
The Apache web server did not close all inherited file descriptors by itself, which could lead to other processes being block indefinitely. This behaviour has been corrected (Bug 37952).
The UCS overview background image has been adjusted. The style of the UCS overview modules has been adjusted to match the style of the UMC. The display of the modules has been slightly adjusted (Bug 37780).
The configuration of the SSL/TLS support in Apache has been improved:
- If the new UCR variable apache2/ssl/tlsv11 is set to true, Apache only accepts TLS 1.1 and TLS 1.2.
- If the new UCR variable apache2/ssl/tlsv12 is set to true, Apache only accepts TLS 1.2.
- SSL compression disabled by default for security reasons, it can be enabled using the UCR variable apache2/ssl/compression.
- Apache no longer accepts various insecure ciphers and hash algorithms (e.g. RC4, MD5 and the outdated export ciphers) by default. Note that such algorithms would not have been negotiated if the TLS client supports current crypto algorithms. A different set of ciphers can be configured using the new UCR variable apache2/ssl/ciphersuite.
- If the new UCR variable apache2/ssl/honorcipherorder is set, the server choice of ciphers is used instead of the ciphers preferred by the TLS client.
Please refer to the Univention Configuration Registry variable descriptions for additional details (Bug 35456).
Support for forcing a port in the URL shown in the ucs-overview page has been added. This is done by setting the Univention Configuration Registry variable ucs/web/overview/entries/*/*/port_http and .../port_https (Bug 37566).

§6.7.7. PAM / Local group cache

The setup to deny ssh logins on Domaincontrollers has been moved into the join scripts, as those restrictions were not applied in all cases (Bug 37971).

§6.8. Virtualization

§6.8.1. Univention Virtual Machine Manager (UVMM)

A memory leak caused by parsing XML documents has been fixed (Bug 36640).
Missing translation has been added (Bug 36567).
The error message has been made more understandable if the cloud end point returns an error due to a blocked account, incorrect server time or missing Amazon IAM policies to interact with EC2 (Bug 37099).
Some unused code has been removed (Bug 36635).
A display error of the icon for VNC access in Firefox has been corrected in the UMC module (Bug 36678).
An error in the grid of the UMC module resulted in an endless refreshing loop of the grid if no connection was available. This has been adjusted (Bug 38010).
Orphaned widget references in the UMC module that would lead to a growing memory consumption in the browser are now cleaned up (Bug 36615).
The Debian Installer does no longer set the Univention Configuration Registry variable locale/keymap, which caused the join script to use en-us as default keyboard layout. This has been fixed (Bug 37551).

§6.9. Container Technologies

The container technology software docker.io is now available under UCS to pull and run Docker containers (Bug 37642).

§6.10. Services for Windows

§6.10.1. Samba

The Windows Server 2008 R2 Foundation member server license check failed in Samba/AD domains (Bug 37687).
NetApp filer NAS devices joined to a Samba/AD DC failed to lookup SIDs due to an issue in negotiating strong encryption for server authentication (Bug 37874).
If the first configured LDAP server was not reachable, timeouts could occur during the share access on a member server. This has been fixed (Bug 36805).

§6.10.2. Univention AD Takeover

This update fixes a traceback which occurred when Active Directory built-in accounts where positioned in an non-default location in the AD LDAP directory (Bug 37596).

§6.10.3. Univention S4 Connector

The password expiry attributes are now set in OpenLDAP if the password has been changed in Active Directory/Samba 4 (Bug 36317).
Synchronisation of the domain password properties has been added (Bug 28331).

§6.10.4. Univention Active Directory Connection

While synchronizing an object from Active Directory to UCS the UCS target object is now checked. If the UCS object should be ignored, the UCS object will not be modified or moved (Bug 37351).

§6.11. Other changes

Several packages have been added to the maintained package repository of UCS (Bug 36467).
The list of public SSL root certificates has been updated (Bug 37885).
An error in a network script terminated the DHCP script responsible for updating the network configuration too early, which lead to RFC 3442 classless routes not being applied (Bug 37689).
Limit collection of files by univention-log-collector to the configured base path (Bug 36452).
If the first configured LDAP server was not reachable, timeouts could occur during the login. This has been fixed in univention-home-mounter (Bug 36805).

§Literaturverzeichnis

[ext-doc-inst] Univention GmbH. 2014. Extended installation documentation. https://docs.software-univention.de/installation-4.0.html.