Secure Communication Processes in UCS with (Self-generated and Signed) Certificates

Certificates – Why and What for

In this article I would like to give you an insight into the topic “Securing the Internet-based exchange of information through certificates”. I’ll take a quick look back at the beginnings of the Internet and the use of protocols such as HTTP, SMTP, POP … and their encrypted transport via SSL or TLS. Above all, however, I would like to explain to you how you can use public certificates with Univention Corporate Server to secure your data transfer or also how you can create trustworthy certificates by yourself with Let’s Encrypt. Completely secure and free of charge on top.

Create an SSO Login for Applications to Groups

SSO mit SAML für UCS-Gruppen
Since the introduction of single sign-on support in Univention Corporate Server (UCS) via Secure Authentication Markup Language (SAML), an administrator can assign a user within the user object to those applications, called service providers in the SAML context, he or she can log in to via single sign-on. As for administrators in organizations with many users, this assignment can be time-consuming.

Film Tutorial: How to Add a Windows 10 Computer to a UCS Domain

In our 4-minute film tutorial we will show you how to add a Windows 10 computer to your UCS domain. First, we will prepare the UCS domain by installing the software package “Active Directory Domain Controller” from the Univention App Center. The Active Directory Domain Controller is an app which extends UCS with Active Directory functions. This makes it possible to operate an Active Directory compatible domain controller with UCS and thus login to a Windows client. In addition, replication mechanisms are used to synchronize data with other domain controllers.

Setting up an Automatic Account Lockout after Failed Login Attempts

By default, UCS users can enter the password incorrectly any number of times without being locked out by the system. In order to make brute force attacks to crack passwords more difficult, admins can set up an automatic lockout that prevents an account from being accessed after a user-defined number of failed attempts.

Univention Corporate Server offers several methods for authentication and authorization. In this blog article I will show you how to log failed login attempts to the system via PAM stack, OpenLDAP and Samba respectively and how you as an admin can set a limit for the number of unsuccessful logins.

Film Tutorial: UCS Admin Diary for Sysadmins

Every systemadministrator has this problem: When did I set up this one function or when did I change the password? To answer these questions we have developed a diary for sysadmins: UCS Admin Diary. The application provides a quick overview of all administrative events in a UCS domain. This includes software and app installations and updates, creating, changing and deleting users and other directory service objects, and password changes.

Domain Replication Service (DRS) with Samba for Empowering Distributed Environments

In larger environments with thousands of users, you can often find multiple Domain Controller offering authentication and authorization services. For Windows-based endpoints, UCS utilizes Samba 4 to provide these services. In between the different Samba 4 servers, UCS uses the Domain Replication Service (DRS) to keep the server data synchronized. While Samba 4 does a superb job in replicating the data, there are some tweaks you can utilize to optimize the replication, to provide better performance in distributed environments. Let us have a look!

Secure Passwords for the UCS Domain

Obviously, your first name, cat’s name or mother-in-law’s birthday are not good passwords. Also password or 123456 (actually to be found on the list of the most frequently chosen passwords!) are out of the question. As the administrator of a UCS domain, you can’t prevent users from writing down their passwords or storing them under the keyboard, but you can tweak other settings to make the system more secure.
Policies can, for example, be used to specify a minimum length or to require users to change passwords regularly. In addition, Univention Corporate Server provides a quality check that forces the use of a certain number of numbers, special characters, uppercase and lowercase letters in passwords. This article presents some tips and tricks for setting up a good password policy in an UCS domain. We also show what variables can be set in the Univention Configuration Registry to optimize the whole thing. If you are using Samba in your environment, this article will also explain how to adjust the password requirements for the Samba domain object to those of the new policy.

Web Proxy and “Shalla List” for Access Rules to External Websites and Higher Performance at the Same Time

For the IT administration of organizations with many users, typically also schools, it can be very useful to regulate the access to external websites. From a technical point of view, in order to improve performance when accessing frequently visited pages, but also in terms of restricting access to certain pages, e.g. for security reasons or to protect minors.
The web proxy, which is a central component of UCS@School, is used to improve performance and control data traffic. In this blog article I’ll show you how to configure Squid Proxy with SquidGuard and how to combine both with existing (youth protection) website filters. And with the “Shalla-List-Downloader” I would like to present you a Cool Solution, with which you can further round off this protection and which we have already successfully implemented in various school projects.

Distributed Data Storage with UCS and Ceph. More Servers, More Storage, More Reliability

More Services, More Space, Less Downtime?

Anyone operating IT services for companies or organisations will sooner or later be confronted with this: everything is growing, you need more space for data and virtual machines, at the same time the demands for the availability of services are increasing and the hardware servers also need to be maintained.

Classic solutions for available storage such as NAS (Network Attached Storage) and SAN (Storage Area Network) systems are often expensive and just as often proprietary – and therefore not necessarily the basis you want to build your own IT infrastructure on as part of an open source strategy.