| Author |
Message
|
| smahon |
 Posted: Mon May 13, 2002 9:05 am Post subject: |
 |
|
Apprentice
Joined: 24 Apr 2002
Posts: 29
|
The DL header had 2029, I suspect because it was a data-gram instead of a request. I used amqsputc to send this bogus message with my own typed data. If the command server is not running, the message stays in the SYSTEM.ADMIN.COMMAND.QUEUE.
If I remove authority to connect to the queue manager (via setmqaut), the amqsputc program can no longer connect (2035).
| mrlinux wrote: |
So what is the reason for being in the DLQ, I am assuming it is the 2035,
which means whatever the command was it was read from the queue
and the security error was for the processing of the command againist the
QMGR |
Last edited by smahon on Mon May 13, 2002 9:11 am; edited 1 time in total |
|
| Back to top |
|
 |
| kolban |
| Posted: Mon May 13, 2002 9:05 am Post subject: |
|
|
Grand Master
Joined: 22 May 2001
Posts: 1072
Location: Fort Worth, TX, USA
|
The amqsputc messages ending up on the DLQ when put to the system command queue is expected. After all, those messages are not command messages, just test ones.
When you get the 2035 authorization error, what is logged on the target queue manager's error log file? |
|
| Back to top |
|
|
| smahon |
| Posted: Mon May 13, 2002 9:20 am Post subject: |
|
|
Apprentice
Joined: 24 Apr 2002
Posts: 29
|
The *only* errors in the queue manager specific error log (/var/mqm/qmgrs/SBQMHUB/errors) is the tcp disconnect error when I exit the amqsputc program with cntrl-c.
The *only* errors in the /var/mqm/errors log is from the "File error" I get when trying to stop a channel with my "authorized" user id (test1) on AIX.
| kolban wrote: |
The amqsputc messages ending up on the DLQ when put to system command queue is expected. After all, those messages are not command messages, just test ones.
When you get the 2035 authorization error, what is logged on the target queue manager's error log file? |
|
|
| Back to top |
|
|
| mrlinux |
| Posted: Mon May 13, 2002 9:23 am Post subject: |
|
|
Grand Master
Joined: 14 Feb 2002
Posts: 1261
Location: Detroit,MI USA
|
Have you tried the trace I suggested earlier ????
_________________
Jeff
IBM Certified Developer MQSeries
IBM Certified Specialist MQSeries
IBM Certified Solutions Expert MQSeries |
|
| Back to top |
|
|
| smahon |
| Posted: Mon May 13, 2002 10:11 am Post subject: On its way... |
|
|
Apprentice
Joined: 24 Apr 2002
Posts: 29
|
The command you said to use is not available on AIX. I used:
trace -a -j30D,30E -o mytrace.dat
The formatted trace file is on its way to you.
| mrlinux wrote: |
| Have you tried the trace I suggested earlier ???? |
|
|
| Back to top |
|
|
| smahon |
| Posted: Mon May 13, 2002 10:28 am Post subject: Success!!!!! |
|
|
Apprentice
Joined: 24 Apr 2002
Posts: 29
|
| I managed to connect via MQ explorer by adding access to the SYSTEM.DEFAULT.MODEL.QUEUE. I will post more data later on the "minimum" access required to connect. |
|
| Back to top |
|
|
| mrlinux |
| Posted: Mon May 13, 2002 10:29 am Post subject: |
|
|
Grand Master
Joined: 14 Feb 2002
Posts: 1261
Location: Detroit,MI USA
|
Well I never have done MQ Trace on AIX thanks for the info.
Well I checked the trace and you not going to believe what I found.
The MQOPEN is failing to open the SYSTEM.DEFAULT.MODEL.QUEUE
probaly related to generating a reply to your command.
Well I just read your post. you found the same thing I did I guess
_________________
Jeff
IBM Certified Developer MQSeries
IBM Certified Specialist MQSeries
IBM Certified Solutions Expert MQSeries |
|
| Back to top |
|
|
| smahon |
| Posted: Mon May 13, 2002 11:56 am Post subject: Perhaps a faq item...... |
|
|
Apprentice
Joined: 24 Apr 2002
Posts: 29
|
OK, here it is, the minimum set of authorizations (for a windows/UNIX user that is NOT part of the mqm group on UNIX) to connect to a UNIX queue manager via MQ Explorer.
NOTE: this will not grant browse access to all the objects of the queue manager, just the ability to connect to it.
setmqaut -m $qmgr -t qmgr -g $grp +inq +connect +dsp
setmqaut -m $qmgr -t q -n SYSTEM.ADMIN.COMMAND.QUEUE -g $grp +inq +put
setmqaut -m $qmgr -t q -n SYSTEM.DEFAULT.MODEL.QUEUE -g $grp +browse +inq +get
Perhaps this should go into the faq??? |
|
| Back to top |
|
|
| XIPO |
| Posted: Fri Jan 10, 2003 2:17 am Post subject: Re: Perhaps a faq item...... |
|
|
Novice
Joined: 17 Dec 2002
Posts: 13
Location: Spain
|
I´ve been looking your doubts about security, and I think that now I´m in the same problem, and I have one question for you:
1.- On AIX, is posible assign authorizations to an specific user?, I thougth it was possible but I assigned the permisssions that you wrote (to my user not to a group):
"setmqaut -m G.QM -t qmgr -p Tom +inq +connect +dsp"
"setmqaut -m G.QM -t q -n SYSTEM.ADMIN.COMMAND.QUEUE -p Tom +inq +put"
"setmqaut -m G.QM -t q -n SYSTEM.DEFAULT.MODEL.QUEUE -p Tom +browse +inq +get"
and I can´t connect to the queue manager from my win2000 machine.
Note: Tom owns "mqm" group on win2000, but on AIX only "staff". |
|
| Back to top |
|
|
| mrlinux |
| Posted: Fri Jan 10, 2003 4:32 am Post subject: |
|
|
Grand Master
Joined: 14 Feb 2002
Posts: 1261
Location: Detroit,MI USA
|
Well you cant use mixed case on NT to Unix, I think it needs to be Uppercase could be wrong though on that part.
_________________
Jeff
IBM Certified Developer MQSeries
IBM Certified Specialist MQSeries
IBM Certified Solutions Expert MQSeries |
|
| Back to top |
|
|
| smahon |
| Posted: Fri Jan 10, 2003 6:39 am Post subject: Re: Perhaps a faq item...... |
|
|
Apprentice
Joined: 24 Apr 2002
Posts: 29
|
AIX, and all UNIX platforms, use group based security only. The commands are very misleading by allowing you to specify a specific user. What is actually happening is that you are granting Tom's entire group, in this case "staff", the access you wanted to give Tom.
That being said, if the userid is really "Tom", and not "tom", your commands should have allowed access, though perhaps to many more users than you expected. |
|
| Back to top |
|
|
|
|
