WMQ and JAVA on Windows / UNIX

[Dave Corbett]

All,

This is a fairly dumb question - but with security patching and JAVA
updates always occurring, I feel the need to ask:

Is JAVA required on a Windows or Linux (SUSE) implementation?

Outside of the MQ Explorer GUI on Windows, I can't think of anything that
would require JAVA since it seems to me that all of the tracing mechanisms
are C-based (or some variant of C). That would also state that the Linux
environment is absolutely free from JAVA - since the Explorer GUI does not
run there.

Any comments out there? I am not sure that I want to remove JAVA from my
MQ servers, but it would solve some patching issues related to
vulnerabilities.

Thanks,
David Corbett
IBM Certified Solution Designer - WebSphere MQ V7.0
IBM Certified System Administrator - WebSphere MQ V7.0
U.S. BANCORP made the following annotations
---------------------------------------------------------------------
Electronic Privacy Notice. This e-mail, and any attachments, contains information that is, or may be, covered by electronic communications privacy laws, and is also confidential and proprietary in nature. If you are not the intended recipient, please be advised that you are legally prohibited from retaining, using, copying, distributing, or otherwise disclosing this information in any manner. Instead, please reply to the sender that you have received this communication in error, and then immediately delete it. Thank you in advance for your cooperation.



---------------------------------------------------------------------


To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html

[Roger Lacroix]

Hi David,

> but with security patching and JAVA updates always occurring

The Java security issues come from the Java plugin for IE, Firefox,
etc. When you are installing Java, simply deselect that
option. Hence, if you go to an infected web site, it cannot do
anything to because your browser does not have the Java plugin.

> I am not sure that I want to remove JAVA from my MQ servers, but
it would solve some patching issues related to vulnerabilities.

Sure you can, but if you are not using a browser on those servers
then someone is getting you to chase your tail for absolutely no
reason. 99% of the current Java exploits is because the user goes to
an infected web site and they have a Java plugin installed in their
browser that is not up-to-date.

Secondly, Oracle/Sun has a "server" edition of Java (JVM) that you
can download and use.

Third, Oracle/Sun makes available a non-installer release of the JDK
& JRE. All you do is unzip & un-tar the file into whatever directory
you want then set the appropriate PATH and JRE_HOME environment
variables and you are good to go. Note: This is what I do on my
Windows, Linux and Solaris servers. Hence, Java is available to
locally started applications but not for any of the browsers.

Its like deleting unused SVRCONN channels. If they are not available
then nobody can use them. :)

Regards,
Roger Lacroix
Capitalware Inc.

At 10:20 AM 7/8/2013, you wrote:
>All,
>
>This is a fairly dumb question - but with security patching and JAVA
>updates always occurring, I feel the need to ask:
>
>Is JAVA required on a Windows or Linux (SUSE) implementation?
>
>Outside of the MQ Explorer GUI on Windows, I can't think of anything
>that would require JAVA since it seems to me that all of the tracing
>mechanisms are C-based (or some variant of C). That would also
>state that the Linux environment is absolutely free from JAVA -
>since the Explorer GUI does not run there.
>
>Any comments out there? I am not sure that I want to remove JAVA
>from my MQ servers, but it would solve some patching issues related
>to vulnerabilities.
>
>Thanks,
>David Corbett
>IBM Certified Solution Designer - WebSphere MQ V7.0
>IBM Certified System Administrator - WebSphere MQ V7.0
>
>U.S. BANCORP made the following
>annotations---------------------------------------------------------------------Electronic
>Privacy Notice. This e-mail, and any attachments, contains
>information that is, or may be, covered by electronic communications
>privacy laws, and is also confidential and proprietary in nature. If
>you are not the intended recipient, please be advised that you are
>legally prohibited from retaining, using, copying, distributing, or
>otherwise disclosing this information in any manner. Instead, please
>reply to the sender that you have received this communication in
>error, and then immediately delete it. Thank you in advance for your
>cooperation.
>
>---------------------------------------------------------------------
>
>
>----------
><http://listserv.meduniwien.ac.at/archives/mqser-l.html>List Archive
>-
><http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1>Manage
>Your List Settings -
><mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>Unsubscribe
>
>
>Instructions for managing your mailing list subscription are
>provided in the Listserv General Users Guide available at
><http://www.lsoft.com/resources/manuals.asp>http://www.lsoft.com

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html

[Jefferson Lowrey]

MQ core functions are not java based, there is no running JVM that is part
of the queue manager processes.

So, as you say, outside of WMQ Explorer, which is an eclipse application
which is based on java, MQ itself does not require the use of a Java
runtime.

So if none of your applications are making bindings connections, and
running Java, to the best of my knowledge you don't need Java on the MQ
server.

It's possible that iKeyman or other GSKit tools need Java, particularly to
create jks files.

And MQExplorer should run on Linux? Although you might not install it on
your server machines.

Thank you,

Jeff Lowrey



From: Dave Corbett <DAVID.CORBETT-nU+***@public.gmane.org>
To: MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org,
Date: 07/08/2013 10:25 AM
Subject: [MQSERIES] WMQ and JAVA on Windows / UNIX
Sent by: MQSeries List <MQSERIES-JX7+OpRa80QeFbOYke1v4oOpTq8/***@public.gmane.org>



All,

This is a fairly dumb question - but with security patching and JAVA
updates always occurring, I feel the need to ask:

Is JAVA required on a Windows or Linux (SUSE) implementation?

Outside of the MQ Explorer GUI on Windows, I can't think of anything that
would require JAVA since it seems to me that all of the tracing mechanisms
are C-based (or some variant of C). That would also state that the Linux
environment is absolutely free from JAVA - since the Explorer GUI does not
run there.

Any comments out there? I am not sure that I want to remove JAVA from my
MQ servers, but it would solve some patching issues related to
vulnerabilities.

Thanks,
David Corbett
IBM Certified Solution Designer - WebSphere MQ V7.0
IBM Certified System Administrator - WebSphere MQ V7.0
U.S. BANCORP made the following annotations
---------------------------------------------------------------------
Electronic Privacy Notice. This e-mail, and any attachments, contains
information that is, or may be, covered by electronic communications
privacy laws, and is also confidential and proprietary in nature. If you
are not the intended recipient, please be advised that you are legally
prohibited from retaining, using, copying, distributing, or otherwise
disclosing this information in any manner. Instead, please reply to the
sender that you have received this communication in error, and then
immediately delete it. Thank you in advance for your cooperation.


---------------------------------------------------------------------


List Archive - Manage Your List Settings - Unsubscribe
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html

[Meekin, Paul]

Hi Dave,

We've just gone through all this pain patching our 7.0.1.7 systems because of JRE vulnerabilities.

There are 2 components of MQ 7.0.1 that contain a complete JRE - MQSeriesJRE and MQSeriesKeyMan are the rpm package names, other platforms have similar names. I suspect you might be able to remove them without it affecting anything other than the ability to run ikeyman. Or at least I haven't seen any other packages that have these as dependencies.

Note that on MQ 7.5 it looks like the MQSeriesJRE package contains only a zipped file of the JRE so presumably the installation routine is unzipping it. I would be interested to know if this can be prevented or failing that maybe just don't install it?

Cheers,
Paul


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Dave Corbett
Sent: 08 July 2013 15:20
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org
Subject: WMQ and JAVA on Windows / UNIX

All,

This is a fairly dumb question - but with security patching and JAVA updates always occurring, I feel the need to ask:

Is JAVA required on a Windows or Linux (SUSE) implementation?

Outside of the MQ Explorer GUI on Windows, I can't think of anything that would require JAVA since it seems to me that all of the tracing mechanisms are C-based (or some variant of C). That would also state that the Linux environment is absolutely free from JAVA - since the Explorer GUI does not run there.

Any comments out there? I am not sure that I want to remove JAVA from my MQ servers, but it would solve some patching issues related to vulnerabilities.

Thanks,
David Corbett
IBM Certified Solution Designer - WebSphere MQ V7.0
IBM Certified System Administrator - WebSphere MQ V7.0

U.S. BANCORP made the following annotations
---------------------------------------------------------------------
Electronic Privacy Notice. This e-mail, and any attachments, contains information that is, or may be, covered by electronic communications privacy laws, and is also confidential and proprietary in nature. If you are not the intended recipient, please be advised that you are legally prohibited from retaining, using, copying, distributing, or otherwise disclosing this information in any manner. Instead, please reply to the sender that you have received this communication in error, and then immediately delete it. Thank you in advance for your cooperation.


---------------------------------------------------------------------

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html

[Meekin, Paul]

Just checked that MQSeriesGSKit-7.5 has MQSeriesJRE as a dependency.....

Is this for anything more than running ikeyman?

From: Meekin, Paul [CCC-OT_IT]
Sent: 09 July 2013 10:02
To: 'MQSeries List'
Subject: RE: WMQ and JAVA on Windows / UNIX

Hi Dave,

We've just gone through all this pain patching our 7.0.1.7 systems because of JRE vulnerabilities.

There are 2 components of MQ 7.0.1 that contain a complete JRE - MQSeriesJRE and MQSeriesKeyMan are the rpm package names, other platforms have similar names. I suspect you might be able to remove them without it affecting anything other than the ability to run ikeyman. Or at least I haven't seen any other packages that have these as dependencies.

Note that on MQ 7.5 it looks like the MQSeriesJRE package contains only a zipped file of the JRE so presumably the installation routine is unzipping it. I would be interested to know if this can be prevented or failing that maybe just don't install it?

Cheers,
Paul


From: MQSeries List [mailto:MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org] On Behalf Of Dave Corbett
Sent: 08 July 2013 15:20
To: MQSERIES-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org<mailto:MQSERIES-0lvw86wZMd9k/***@public.gmane.orgAC.AT>
Subject: WMQ and JAVA on Windows / UNIX

All,

This is a fairly dumb question - but with security patching and JAVA updates always occurring, I feel the need to ask:

Is JAVA required on a Windows or Linux (SUSE) implementation?

Outside of the MQ Explorer GUI on Windows, I can't think of anything that would require JAVA since it seems to me that all of the tracing mechanisms are C-based (or some variant of C). That would also state that the Linux environment is absolutely free from JAVA - since the Explorer GUI does not run there.

Any comments out there? I am not sure that I want to remove JAVA from my MQ servers, but it would solve some patching issues related to vulnerabilities.

Thanks,
David Corbett
IBM Certified Solution Designer - WebSphere MQ V7.0
IBM Certified System Administrator - WebSphere MQ V7.0

U.S. BANCORP made the following annotations
---------------------------------------------------------------------
Electronic Privacy Notice. This e-mail, and any attachments, contains information that is, or may be, covered by electronic communications privacy laws, and is also confidential and proprietary in nature. If you are not the intended recipient, please be advised that you are legally prohibited from retaining, using, copying, distributing, or otherwise disclosing this information in any manner. Instead, please reply to the sender that you have received this communication in error, and then immediately delete it. Thank you in advance for your cooperation.


---------------------------------------------------------------------

________________________________
List Archive<http://listserv.meduniwien.ac.at/archives/mqser-l.html> - Manage Your List Settings<http://listserv.meduniwien.ac.at/cgi-bin/wa?SUBED1=mqser-l&A=1> - Unsubscribe<mailto:LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org?subject=Unsubscribe&BODY=signoff%20mqseries>

Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com<http://www.lsoft.com/resources/manuals.asp>

To unsubscribe, write to LISTSERV-0lvw86wZMd9k/bWDasg6f+***@public.gmane.org and,
in the message body (not the subject), write: SIGNOFF MQSERIES
Instructions for managing your mailing list subscription are provided in
the Listserv General Users Guide available at http://www.lsoft.com
Archive: http://listserv.meduniwien.ac.at/archives/mqser-l.html