<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.28.3">
</HEAD>
<BODY>
Thanks for all the replies. <BR>
<BR>
Perhaps a thread that seemed to run through it is that there is a difference between: <BR>
<BR>
Aiming for best security (by using Redhat and appying patches) but maybe more challenge with VA scan. <BR>
Aiming to pass the quarterly VA Scan (by loading the most current Apache version a week before the scan and not doing any security patches for 3 months. ) <BR>
Aiming to pass a PCI audit. <BR>
<BR>
Neal Rhodes<BR>
MNOP Ltd<BR>
<BR>
<BR>
On Mon, 2013-08-12 at 20:54 -0400, Wolf Halton wrote:<BR>
<BLOCKQUOTE TYPE=CITE>
If you have to be PCI-compliant. Redhat is probably the vendor you want the auditors to see here.<BR>
RedHat is always behind all the upstream projects.<BR>
<BR>
If you have more than a handful of servers, homogenize your servees as much as you can. Hand-rolled source is great for test boxes, but impossible to maintain at scale.<BR>
<BR>
Wolf Halton<BR>
--<BR>
<A HREF="http://wolfhalton.info">http://wolfhalton.info</A> <BR>
Apache developer:<BR>
<A HREF="mailto:wolfhalton@apache.org">wolfhalton@apache.org</A><BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
On Aug 12, 2013 2:26 PM, "Jim Kinney" <<A HREF="mailto:jim.kinney@gmail.com">jim.kinney@gmail.com</A>> wrote:
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BLOCKQUOTE>
RHEL Tomcat will work just fine with Oracle JDK. You just have to do the alternatives song-n-dance to make it the default. So install the OpenJDK AND Oracle and make sure you block further updates to OpenJDK in yum/RHN. Be ready to unblock if a security patch for tomcat calls for an updated tomcat which wil then force the OpenJDK to update and likely force alternatives back to openJDK from Oracle.<BR>
<BR>
<BR>
</BLOCKQUOTE>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BLOCKQUOTE>
Good luck getting a Non-RedHat vendor to code with OpenJDK.<BR>
<BR>
</BLOCKQUOTE>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BLOCKQUOTE>
<BR>
<BR>
</BLOCKQUOTE>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BLOCKQUOTE>
On Mon, Aug 12, 2013 at 1:47 PM, James Sumners <<A HREF="mailto:james.sumners@gmail.com">james.sumners@gmail.com</A>> wrote:<BR>
<BLOCKQUOTE>
My problem with the RH provided Tomcat is it depends on OpenJDK. If<BR>
you have to worry about support from an application vendor (not RH),<BR>
then they are likely requiring the Oracle JDK. Additionally, the last<BR>
time I tried to get the Tomcat native libraries to work with RH's<BR>
package it was a no-go (had to use the JBoss repos which I don't have<BR>
license for).<BR>
<BR>
I do not, however, compile Tomcat from source for my servers. I use<BR>
the binary packages available from Apache.
</BLOCKQUOTE>
</BLOCKQUOTE>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BLOCKQUOTE>
<BLOCKQUOTE>
<BR>
On Mon, Aug 12, 2013 at 12:40 PM, Neal Rhodes <<A HREF="mailto:neal@mnopltd.com">neal@mnopltd.com</A>> wrote:<BR>
<BR>
</BLOCKQUOTE>
</BLOCKQUOTE>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BLOCKQUOTE>
<BLOCKQUOTE>
> Trying to get back on A topic which relates to linux....<BR>
><BR>
> If you were charged with putting up a secure internal Web Services framework<BR>
> on RedHat Enterprise Linux 6.4 for a financial application, would you:<BR>
><BR>
> "yum install tomcat6"<BR>
><BR>
> or,<BR>
><BR>
> go to Apache.org, download the sources, compile, and pray.<BR>
><BR>
><BR>
> No, this is not a trick question. I've always just used the tested<BR>
> supplied Redhat version which "just works". But there are apparently other<BR>
> opinions, just trying to figure out if they are crazy.<BR>
><BR>
> Neal Rhodes<BR>
> MNOP Ltd<BR>
><BR>
<BR>
</BLOCKQUOTE>
</BLOCKQUOTE>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BLOCKQUOTE>
<BLOCKQUOTE>
> _______________________________________________<BR>
> Ale mailing list<BR>
> <A HREF="mailto:Ale@ale.org">Ale@ale.org</A><BR>
> <A HREF="http://mail.ale.org/mailman/listinfo/ale">http://mail.ale.org/mailman/listinfo/ale</A><BR>
> See JOBS, ANNOUNCE and SCHOOLS lists at<BR>
> <A HREF="http://mail.ale.org/mailman/listinfo">http://mail.ale.org/mailman/listinfo</A><BR>
><BR>
<BR>
<BR>
<BR>
--<BR>
<BR>
</BLOCKQUOTE>
</BLOCKQUOTE>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BLOCKQUOTE>
<BLOCKQUOTE>
James Sumners<BR>
<A HREF="http://james.roomfullofmirrors.com/">http://james.roomfullofmirrors.com/</A><BR>
<BR>
"All governments suffer a recurring problem: Power attracts<BR>
pathological personalities. It is not that power corrupts but that it<BR>
is magnetic to the corruptible. Such people have a tendency to become<BR>
drunk on violence, a condition to which they are quickly addicted."<BR>
<BR>
Missionaria Protectiva, Text QIV (decto)<BR>
CH:D 59
</BLOCKQUOTE>
</BLOCKQUOTE>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BLOCKQUOTE>
<BLOCKQUOTE>
_______________________________________________<BR>
Ale mailing list<BR>
<A HREF="mailto:Ale@ale.org">Ale@ale.org</A><BR>
<A HREF="http://mail.ale.org/mailman/listinfo/ale">http://mail.ale.org/mailman/listinfo/ale</A><BR>
See JOBS, ANNOUNCE and SCHOOLS lists at<BR>
<A HREF="http://mail.ale.org/mailman/listinfo">http://mail.ale.org/mailman/listinfo</A><BR>
<BR>
</BLOCKQUOTE>
</BLOCKQUOTE>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BLOCKQUOTE>
<BR>
<BR>
<BR>
--
</BLOCKQUOTE>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BLOCKQUOTE>
-- <BR>
James P. Kinney III<BR>
<BR>
Every time you stop a school, you will have to build a jail. What you gain at one end you lose at the other. It's like feeding a dog on his own tail. It won't fatten the dog.<BR>
- Speech 11/23/1900 Mark Twain<BR>
<BR>
<I><A HREF="http://heretothereideas.blogspot.com/">http://heretothereideas.blogspot.com/</A></I><BR>
<BR>
</BLOCKQUOTE>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BLOCKQUOTE>
<BR>
_______________________________________________<BR>
Ale mailing list<BR>
<A HREF="mailto:Ale@ale.org">Ale@ale.org</A><BR>
<A HREF="http://mail.ale.org/mailman/listinfo/ale">http://mail.ale.org/mailman/listinfo/ale</A><BR>
See JOBS, ANNOUNCE and SCHOOLS lists at<BR>
<A HREF="http://mail.ale.org/mailman/listinfo">http://mail.ale.org/mailman/listinfo</A><BR>
<BR>
</BLOCKQUOTE>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<PRE>
_______________________________________________
Ale mailing list
<A HREF="mailto:Ale@ale.org">Ale@ale.org</A>
<A HREF="http://mail.ale.org/mailman/listinfo/ale">http://mail.ale.org/mailman/listinfo/ale</A>
See JOBS, ANNOUNCE and SCHOOLS lists at
<A HREF="http://mail.ale.org/mailman/listinfo">http://mail.ale.org/mailman/listinfo</A>
</PRE>
</BLOCKQUOTE>
<BR>
</BODY>
</HTML>