Is 7.0.0.Final (Everything) ready and stable for production?

[java-lover]

Hi,

We would like to move to 7.0.0.Final (Everything) in production.

If you read http://www.techworld.com.au/article/393326/red_hat_speeds_jboss_7_market/ - version 7.1, should implement, and receive certification for, the entire Java EE 6 stack.

Are there any people using 7.0.0.Final in production and is it stable underload?

Can 7.0.0.Final (Everything) run well under load with MDB's, Hornet, Spring, Seam, EJB 3.1/3.0 applications?

Or do you advise we need to wait until JBoss 7.1?

Please will some one share their experiences on using this new product.

Rgds

[mechevar]

I too am trying out JBoss 7 for a production environment and ran into a deal breaker.  Unless I find a fix in the forums, I am waiting until 7.1.  The <security-domain> is having trouble masking a password using SecureIdentityLoginModule.  Having the password to the backend datasource in plain text is no go at this point.

[nickarls]

Have you filed a JIRA so the issues doesn't get lost?

[mechevar]

I added the related JIRA issue thats already been filed.  Looks like there is going to be a 7.0.1 release.  Hopefully the encryption bug is fixed.

[jason.greene]

Having the ability to "mask" passwords in configuration is on the 7.1 schedule. However, I just want to add that have seen very few people use this feature in a way that has better security than not masking your passwords. If you do not require human interaction on boot (typing in a password, providing a removable key device etc), then these passwords are trivially reversible. You can also have tighter file perms on the keystore, but you can accomplish the same thing by using good file perms on standalone/domain.xml.

[mechevar]

I agree.  Server security is more important than a masked password.  If a bad actor has access to a server, the damage is done, no simple password mask can help that.  Unfortunately, I have a black and white business rule that passwords cannot be stored in plain text.

[jason.greene]

Michael Echevarria wrote:

I agree.  Server security is more important than a masked password.  If a bad actor has access to a server, the damage is done, no simple password mask can help that.  Unfortunately, I have a black and white business rule that passwords cannot be stored in plain text.

OK I can sympathize with you then. BTW one of our security devs tells me the SecurityIdentityLoginModule has a fix to be merged shortly. I was speaking to the more general problem of masking all passwords (not just DS)

[mmoyses]

FYI https://issues.jboss.org/browse/AS7-1072 is the issue if you want to watch it to see when it gets merged upstream.