<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">(catching up)</div><br class=""><div><blockquote type="cite" class=""><div class="">On 8 Aug 2019, at 20:50, Peter Schober <<a href="mailto:peter.schober@univie.ac.at" class="">peter.schober@univie.ac.at</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">* <a href="mailto:ryazanov@bc.edu" class="">ryazanov@bc.edu</a> <<a href="mailto:ryazanov@bc.edu" class="">ryazanov@bc.edu</a>> [2019-08-08 21:34]:<br class=""><blockquote type="cite" class="">We are moving Shib IdP services from RHEL6 servers to a newer OS version. <br class="">Trying to decide whether we should migrate to RHEL7 or go straight to RHEL8. <br class="">Does anybody have any experience with Shib IdP v3 running on RHEL8? <br class=""></blockquote><br class="">At least on the Java side you should be covered:<br class=""><a href="https://developers.redhat.com/blog/2018/12/10/install-java-rhel8/" class="">https://developers.redhat.com/blog/2018/12/10/install-java-rhel8/</a><br class=""><br class="">I have no idea whether RedHat is packaging a usable Jetty or Tomcat<br class="">version, though.</div></div></blockquote><div><br class=""></div><div>Tomcat and Jetty were both shipped as part of RHEL 7 (in the case of Jetty, as an optional package) but both have been removed from RHEL 8:</div><div><br class=""></div><div><a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/considerations_in_adopting_rhel_8/index" class="">https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/considerations_in_adopting_rhel_8/index</a></div><div><br class=""></div><div><br class=""></div><br class=""><blockquote type="cite" class=""><div class=""><div class=""> (I know the developers may not support those, same as<br class="">they didn't with OS-packaged Java until very recently, but getting<br class="">security fixes automatically seems worthwhile to me, esp if you're<br class="">using those servlet containers as TLS-enbaled web servers, too.)<br class=""></div></div></blockquote><div><br class=""></div><div>You're right, that would be an advantage. The downside is that you're never quite sure which version you're really running, because of all the back-porting they do.</div><div><br class=""></div><div><br class=""></div><div><blockquote type="cite" class=""><div class="">On 8 Aug 2019, at 20:33, <a href="mailto:ryazanov@bc.edu" class="">ryazanov@bc.edu</a> wrote:</div><br class="Apple-interchange-newline"><div class="">We are moving Shib IdP services from RHEL6 servers to a newer OS version. <br class="">Trying to decide whether we should migrate to RHEL7 or go straight to RHEL8. <br class="">Does anybody have any experience with Shib IdP v3 running on RHEL8?<br class=""></div></blockquote><br class=""></div><div>I don't think RHEL 8 has been out long enough for people to have migrated a lot of production to it yet. I've played around with a developer license and given that we're talking about Java and they ship a decent JDK with it, I would expect it to be fine. It certainly runs our internal tests for the software.</div><div><br class=""></div><div>One thing I did notice while validating the statement above is that the system-wide cryptographic policy system introduced in RHEL 8 can catch you unawares if you have anything expecting to, say, use 1024-bit RSA (turned out we had a couple of tests that did that).</div><div><br class=""></div><div>I think the other point of note is that they have removed their own support for Docker (I suspect very few people used the RHEL-supplied Docker, it was always rather out of date) in favour of their own compatible but daemon-less container runtime. This allows tighter integration with systemd and the like, so it may actually be a better fit for service deployment if you're going the container route.</div><div><br class=""></div><div>With the disclaimer that I have no real experience in the risk tradeoffs in enterprise deployments, I'd personally lean towards RHEL 8 (or for those of us in the cheap seats, CentOS 8, which is expected fairly soon now) for new deployments.</div><div><br class=""></div></div><div class=""><span class="Apple-style-span" style="border-collapse: separate; font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; line-height: normal; border-spacing: 0px; -webkit-text-decorations-in-effect: none;"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-stroke-width: 0px;"><div class=""> -- Ian<br class=""></div><div class=""><span class="Apple-style-span" style="font-size: medium;"><br class=""></span></div></span></div></span><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""></body></html>