| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| mcauser |
« View previous topic :: View next topic » |
| Author |
Message
|
| senMQ |
 Posted: Mon Apr 30, 2007 10:12 am Post subject: mcauser |
 |
|
Acolyte
Joined: 14 Aug 2006
Posts: 66
Location: Palo Alto, CA
|
Currently we are running on MQ v6 and have this installed on most of our laptops. We have mcauser set to mqm in the system.admin.svrconn channels in multiple queue managers. This means right now, anyone would be able to access this qmgr through MQ explorer. Can I add specific set of userids to mca user parameter. Right now, I'm not able to add more than one user to mcauser. Is there a way out of this?
Cheers, |
|
| Back to top |
|
 |
| tkane |
| Posted: Mon Apr 30, 2007 10:40 am Post subject: |
|
|
Voyager
Joined: 23 Dec 2002
Posts: 82
Location: Kansas City
|
Yes, mcauser('mqm') is very insecure.
I think the idea of how to do this is to make mcauser(' ') blank. This will allow the ID from the workstation signed on user to be used.
Also, using SSL on this would be the most secure way to handle this channel.
Tom |
|
| Back to top |
|
|
| senMQ |
| Posted: Mon Apr 30, 2007 11:05 am Post subject: |
|
|
Acolyte
Joined: 14 Aug 2006
Posts: 66
Location: Palo Alto, CA
|
| The default value for mcauser is ' '. With this setting none of us would be able to connect to the queue managers using MQ explorer. I want some of our administrators to have this access, but not everyone around. |
|
| Back to top |
|
|
| jefflowrey |
| Posted: Mon Apr 30, 2007 11:05 am Post subject: |
|
|
Grand Poobah
Joined: 16 Oct 2002
Posts: 19981
|
You can't set more than one user in MCAUSER.
You can, however, enable SSL, set the MCAUSER to some particular user that will give the sufficient priviledges (even if you need full admin authorities, it's probably better to create another user than MQM with those authorities), and then use SSL and SSLPEERs to ensure that only certain certificates belonging to certain user ids are valid to connect to the channel.
http://www-128.ibm.com/developerworks/websphere/techjournal/0701_col_wyatt/0701_col_wyatt.html
_________________
I am *not* the model of the modern major general. |
|
| Back to top |
|
|
| senMQ |
| Posted: Mon Apr 30, 2007 11:20 am Post subject: |
|
|
Acolyte
Joined: 14 Aug 2006
Posts: 66
Location: Palo Alto, CA
|
| The default value for mcauser is ' '. With this setting none of us would be able to connect to the queue managers using MQ explorer. I want some of our administrators to have this access, but not everyone around. |
|
| Back to top |
|
|
| jefflowrey |
| Posted: Mon Apr 30, 2007 11:22 am Post subject: |
|
|
Grand Poobah
Joined: 16 Oct 2002
Posts: 19981
|
Yes, the way to do this *out of the box* is with SSL.
_________________
I am *not* the model of the modern major general. |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
