| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| A security exposure..... ideas?! |
« View previous topic :: View next topic » |
| Author |
Message
|
| GEMO! |
 Posted: Fri Mar 10, 2006 5:27 am Post subject: A security exposure..... ideas?! |
 |
|
Apprentice
Joined: 08 Oct 2004
Posts: 33
Location: This World
|
I want to ask what are the suggestions about the following security issue
I think I have an exposure, in my systems, because we are using the SYSTEM.DEF.SVRCONN and SYSTEM.ADMIN.SVRCON, because anyone can connect to a QMgr just by trying to guess the hostname and listener port. It may take them a few tries, but it's not hard. More over we have assigned the mca UserId of mqm to the channel so it have full privileges. So anyone can inject a command and have it honored.
What do you think about the steps that I'm thinking to take:
Create a CLNT.<QMgr>, CLNT1,<QMgr> and CLNT2.<QMgr> on each of the QMgr. On UNIX assign the UserId of staff and on Intel create a local group of mqusers and UserId mcauser. Then grant STAFF and MQUsers access rights to all non-system queues.
Once all the accesses have been converted over to the new channels, we can disable (not delete) the SYSTEM.XXXXX.SVRCONN. In this way we secure the systems.
Comments, thoughs....
Cheeers! 
_________________
GEMO! |
|
| Back to top |
|
 |
| sandiksk |
| Posted: Fri Mar 10, 2006 5:50 am Post subject: |
|
|
Centurion
Joined: 08 Jun 2005
Posts: 133
|
|
| Back to top |
|
|
| jefflowrey |
| Posted: Fri Mar 10, 2006 5:58 am Post subject: |
|
|
Grand Poobah
Joined: 16 Oct 2002
Posts: 19981
|
I would, instead, set the MCAUser on the SYSTEM.DEF.SVRCONN channel to a user that doesn't exist, and then enable SSL on SYSTEM.ADMIN.SVRCONN, assuming your administration tools can support SSL on that channel.
Better still is to put the servers behind a firewall, and only allow access to the listener port from specific machines.
_________________
I am *not* the model of the modern major general. |
|
| Back to top |
|
|
| RogerLacroix |
| Posted: Fri Mar 10, 2006 9:14 am Post subject: |
|
|
Jedi Knight
Joined: 15 May 2001
Posts: 3264
Location: London, ON Canada
|
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
