| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| Broker v7 security setup issue |
« View previous topic :: View next topic » |
| Author |
Message
|
| Sam Uppu |
 Posted: Wed May 12, 2010 7:33 am Post subject: Broker v7 security setup issue |
 |
|
Yatiri
Joined: 11 Nov 2008
Posts: 610
|
Hi,
We are MQ 7.0.1, Broker v7 on AIX 6.1.
I tried with single broker running on the server and facing some issue. Below are the steps followed:
1.) Broker BRSESB001T is created with user 'mbadmin'. mbadmin user is part of both mqm and mqbrkrs groups.
$ id
uid=50537(mbadmin) gid=986(mbadmin) groups=956(mqbrkrs),349(mqm)
| Quote: |
| $mqsicreatebroker BRSESB001T -q SESB001T -s active |
2.) Broker- BRSESB001T is started with user 'mqbrkrs' which is part of mqbrkrs group.
$ id
uid=50522(mqbrkrs) gid=956(mqbrkrs)
| Quote: |
| $mqsistart BRSESB001T |
3.) There is a seperate support group called mqadmin which contains many users who supports the infrastructure.
We are looking for the mqadmin group members to provide minimal permissions to execute minimal mqsi commands like mqsilist etc.
For this to work, below are the permissions provided:
| Quote: |
$ setmqaut -m SESB001T -n SYSTEM.BROKER.AUTH -t queue -g mqadmin +inq (inq only permission on SYSTEM.BROKER.AUTH as recommended in IBM infocenter)
The setmqaut command completed successfully. |
| Quote: |
$ dspmqaut -m SESB001T -n SYSTEM.BROKER.AUTH -t queue -g mqadmin
Entity mqadmin has the following authorizations for object SYSTEM.BROKER.AUTH:
inq |
| Quote: |
$ dspmqaut -m SESB001T -t qmgr -g mqadmin (no permissions provided on QMgr for mqadmin group, also tried with providing +all perms and not successful)
Entity mqadmin has the following authorizations for object SESB001T:
$ |
Ran the REFRESH SECURITY in runmqsc SESB001T.
Now the user 'xyz' is a member of mqadmin is trying to execute mqsilist command and getting an error
$ pwd
/home/xyz
$ id
uid=xyz(xyz) gid=975(mqadmin)
$ . /apps_01/wmb/bin/mqsiprofile
| Quote: |
$ mqsilist
Failed to open file /var/mqsi/registry/utility/HASharedWorkPath with error Permission denied
BIP2113E: Message broker internal error: diagnostic information ''Permission denied'', '13', ''/var/mqsi/registry/utility/HASharedWorkPath''.
An internal software error has occurred in the message broker. Further messages will indicate the effect of this error on the broker's transactions.
Shutdown and restart the message broker. If the problem continues to occur, then restart the system. If the problem still continues to occur contact your IBM support center.
BIP8081E: An error occurred while processing the command.
An error has occurred while the command was running. The command has cleaned up and terminated.
Use messages prior to this one to determine the cause of the error. Correct the problem and retry the command. Check for some common problems :- Does the user id have the correct authorities (for example a member of the mqbrkrs group)? Is the broker database started and operating correctly? Is any operating system limit set too low to allow the command to run? Is the environment correctly set up? Contact your IBM support center if you are unable to resolve the problem. |
Under /var/mqsi/registry, I dont see utility directory. All I see is the below:
$ pwd
/var/mqsi/registry
| Quote: |
$ ls -ltr
total 0
-rw-rw---- 1 mqm mqbrkrs 0 Apr 21 19:04 LOCK
drwxr-sr-x 3 mqbrkrs mqbrkrs 256 May 4 11:21 BRSESB001T |
I can't really provide the permissions for the directory 'HASharedWorkPath' as it doesn't exists. Not sure why it is not created.I have checked on some other server/ broker and I dont see this directory there as well.
Am I missing anything to setup this security?.
Thanks. |
|
| Back to top |
|
 |
| fjb_saper |
| Posted: Wed May 12, 2010 1:35 pm Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
you are missing the point.
mqsilist and other broker commands are admin commands.
If you need to provide access to them you should allow them to be executed by the relevant group in sudo mode. If you need more info about sudo ask your friendly Unix admin. 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
