Java on servers?

[beancole]

Hi All,

 

As a rule I have never installed Java, Flash, shockwave etc. This is something I was taught at college as a precaution for unwanted stuff on your server if no java then it can't run even if it gets on there. It's something I've never really questioned and I've never needed it. I have Dell servers and I would like to keep them up to date with drivers etc and the easiest way is with Dell system detect but this uses java, Does anyone have an opinion on this? Were my lecturers correct keep it off or is it an old fashioned view now?

[DJ-1701]

I would agree that it's a good idea not to have those programs installed unless absolutely necessary. With regard to drivers, I wouldn't tend to update them on the server unless there is a problem with the current drivers, or software required an updated version, for system stability and uptime.

[Davit2005]

I would agree that it's a good idea not to have those programs installed unless absolutely necessary. With regard to drivers, I wouldn't tend to update them on the server unless there is a problem with the current drivers, or software required an updated version, for system stability and uptime.

 

They used to have Java in the server VM templates here but I've since re-done the all templates without Java or any plugins.

[CyberNerd]

I think the general rule that your lecturers were getting at is to only install what is required on your servers. This will keep the attack avenues at a minimum.

I don't think installing JRE itself would be a problem, it's one of the most popular languages ever, and runs much of the internet (tomcat jboss etc). The issue with Java being insecure is really to do with it being used as a browser plugin. So I would say it is safe but don't use your server to browse the interweb.

[Oaktech]

I don't install air/flash/shockwave on servers, and I only install Java if a software package - such as Tucasi Schools Cash Office - demands it. If I do install it, then it is disabled in the browser and fully patched.

[Julian]

I agree, only install the software that is needed, on that server, (and do not use a server to browse the internet).

[Geoff]

As a general rule of thumb I try not to have any interpreters (Java, Silverlight, Ruby, IronPython, Powershell) or compilers (more an issue on *nix) on servers. While in some cases it's necessary (good look runing a Minecraft server without Java) it's best practice to reduce the surface attack area as much as possible.

[Patrick]

Tend to keep it bare if i can, but i needed JRE for my Unifi Controller so that's the only thing i have loaded on.

[sparkeh]

As above I install as little as possible on servers (and Java on as little a possible in general!)

[beancole]

Yeah, thats it it stays off.