Do we still need to include local_policy.jar and US_export_policy.jar

[Lipscomb, Gary]

A correction to [1] below.  I still have the old Oracle java in the config

# find / -name local_policy.jar -exec ls -l {} \;
-rw-r--r-- 1 root root 942 Jan  1  2014 /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.212.b04-0.el7_6.x86_64/jre/lib/security/policy/limited/local_policy.jar
-rw-r--r-- 1 root root 556 Jan  1  2014 /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.212.b04-0.el7_6.x86_64/jre/lib/security/policy/unlimited/local_policy.jar
-rw-rw-r-- 1 root root 3035 Dec 21  2013 /usr/lib/jvm-private/java_1.8_jce_unlimited/local_policy.jar


# find / -name US_export_policy.jar -exec ls -l {} \;
-rw-r--r-- 1 root root 538 Jan  1  2014 /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.212.b04-0.el7_6.x86_64/jre/lib/security/policy/limited/US_export_policy.jar
-rw-r--r-- 1 root root 538 Jan  1  2014 /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.212.b04-0.el7_6.x86_64/jre/lib/security/policy/unlimited/US_export_policy.jar
-rw-rw-r-- 1 root root 3023 Dec 21  2013 /usr/lib/jvm-private/java_1.8_jce_unlimited/US_export_policy.jar


Regards

Gary


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Lipscomb, Gary
Sent: Monday, 17 June 2019 14:29
To: Shib Users <users at shibboleth.net>
Subject: Do we still need to include local_policy.jar and US_export_policy.jar

Hi list,

I'm in the process of cleaning up our build scripts for IdP v3. Our current environment is below:
  Server OS:  RHEL 7
  IdP:  v3.4.4
  Java: RHEL java-1.8.0-openjdk

Do we still need to include the local_policy.jar and US_export_policy.jar in the JVM configuration or are they include by default [1] and just used?
I can only find a reference to them in the IdP v2 configuration [2].

[1]
# find / -name local_policy.jar -exec ls -l {} \;
-rw-r--r-- 1 root root 942 Jan  1  2014 /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.212.b04-0.el7_6.x86_64/jre/lib/security/policy/limited/local_policy.jar
-rw-r--r-- 1 root root 556 Jan  1  2014 /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.212.b04-0.el7_6.x86_64/jre/lib/security/policy/unlimited/local_policy.jar
lrwxrwxrwx 1 root root 46 Jun 14 13:41 /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.212.b04-0.el7_6.x86_64/jre/lib/security/local_policy.jar -> /usr/lib/jvm/jce-1.8.0-oracle/local_policy.jar
-rw-rw-r-- 1 root root 3035 Dec 21  2013 /usr/lib/jvm-private/java_1.8_jce_unlimited/local_policy.jar

# find / -name US_export_policy.jar -exec ls -l {} \;
-rw-r--r-- 1 root root 538 Jan  1  2014 /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.212.b04-0.el7_6.x86_64/jre/lib/security/policy/limited/US_export_policy.jar
-rw-r--r-- 1 root root 538 Jan  1  2014 /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.212.b04-0.el7_6.x86_64/jre/lib/security/policy/unlimited/US_export_policy.jar
lrwxrwxrwx 1 root root 50 Jun 14 13:41 /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.212.b04-0.el7_6.x86_64/jre/lib/security/US_export_policy.jar -> /usr/lib/jvm/jce-1.8.0-oracle/US_export_policy.jar
-rw-rw-r-- 1 root root 3023 Dec 21  2013 /usr/lib/jvm-private/java_1.8_jce_unlimited/US_export_policy.jar


[2]
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPProdJVMTuning

Install Java Unlimited Strength Security Policy

The JVM, by default, contains a security policy that prohibits the use of cryptography keys above a certain size (2048bit for DSA/RSA keys). Some sites have begun using larger key sizes in their CAs and certificates so we recommend people add the Unlimited Strength Security Policy to their JVM. This allows for larger key sized. Note, if you don't install the Bouncy Castle JCE you won't actually get "unlimited" key sizes as the standard JCE only supports a max size of 4096bit DSA/RSA keys.

    Download the security policy zip file: Java 6, Java 7
    Unzip the policy zip and copy local_policy.jar and US_export_policy.jar into the JRE's lib/security directory.



regards

Gary Lipscomb
Technical Officer (Infrastructure), Systems | Infrastructure & Client Services | Division of Information Technology
Charles Sturt University




|   ALBURY-WODONGA   |   BATHURST   |   BRISBANE   |   CANBERRA   |   DUBBO   |   GOULBURN   |   MELBOURNE   |   ORANGE   |   PORT MACQUARIE   |   SYDNEY   |   WAGGA WAGGA   |

LEGAL NOTICE
This email (and any attachment) is confidential and is intended for the use of the addressee(s) only. If you are not the intended recipient of this email, you must not copy, distribute, take any action in reliance on it or disclose it to anyone. Any confidentiality is not waived or lost by reason of mistaken delivery. Email should be checked for viruses and defects before opening. Charles Sturt University does not accept liability for viruses or any consequence which arise as a result of this email transmission. Email communications with Charles Sturt University may be subject to automated email filtering, which could result in the delay or deletion of a legitimate email before it is read at Charles Sturt University. The views expressed in this email are not necessarily those of Charles Sturt University.
Charles Sturt University in Australia The Grange Chancellery, Panorama Avenue, Bathurst NSW Australia 2795 (ABN: 83 878 708 551; CRICOS Provider Number: 00005F (National)). TEQSA Provider Number: PV12018
Consider the environment before printing this email.
-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net