| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| Is it necessary to chmod -R o-rwx for /usr/mqm and /var/mqm? |
« View previous topic :: View next topic » |
| Author |
Message
|
| issac |
 Posted: Tue Jul 17, 2012 4:13 am Post subject: Is it necessary to chmod -R o-rwx for /usr/mqm and /var/mqm? |
 |
|
Disciple
Joined: 02 Oct 2008
Posts: 158
Location: Shanghai
|
Hello,
I'm working on a system of some importance. I found default permissions in /var/mqm are mostly set to -rwxrwxr-x on AIX. It means the "other" could view most of my files. Is it a bit too much?
Should I use chmod -R o-rwx for /usr/mqm and /var/mqm? Is this ever considered a necessary step to enforce the QMGR security?
Thanks in advance.
_________________
Bazinga! |
|
| Back to top |
|
 |
| exerk |
| Posted: Tue Jul 17, 2012 4:16 am Post subject: |
|
|
Jedi Council
Joined: 02 Nov 2006
Posts: 6339
|
There are many, many posts on this site in regard to the perils of 'playing around' with the permissions on WMQ directories, not a few of which end with "...the quickest way to recover the correct permissions is to uninstall WMQ and then re-install it...".
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys. |
|
| Back to top |
|
|
| Vitor |
| Posted: Tue Jul 17, 2012 4:43 am Post subject: Re: Is it necessary to chmod -R o-rwx for /usr/mqm and /var/ |
|
|
Grand High Poobah
Joined: 11 Nov 2005
Posts: 26093
Location: Texas, USA
|
| issac wrote: |
| I'm working on a system of some importance. I found default permissions in /var/mqm are mostly set to -rwxrwxr-x on AIX. It means the "other" could view most of my files. Is it a bit too much? |
If it is, you should be thinking about using the AMS component of WMQv7.5 rather than this, which as my associate points out is a road that only leads to pain.
| issac wrote: |
| Should I use chmod -R o-rwx for /usr/mqm and /var/mqm? Is this ever considered a necessary step to enforce the QMGR security? |
I wouldn't do it, and if you're that worried about queue manager security (aside from considering AMS) I would urge you to focus your efforts on the more vunerable spots, such as connection security and queue access. It's going to be pointless for you to lock down the file system access if anyone with an ounce of knowledge can walk into the queue manager and examine the queue contents via the APIs.
_________________
Honesty is the best policy.
Insanity is the best defence. |
|
| Back to top |
|
|
| bruce2359 |
| Posted: Tue Jul 17, 2012 1:24 pm Post subject: |
|
|
Poobah
Joined: 05 Jan 2008
Posts: 9469
Location: US: west coast, almost. Otherwise, enroute.
|
Appropriate filesystem permissions are set during WMQ product installation. It is well-documented: DO NOT CHANGE FILESYSTEM PERMISSIONS.
I'm going to guess that nobody will confess to changing permissions, OR even knowing why this was done.
Members of mqm have appropriate authority to do admin work with provided/supported tools without changing permissions.
End-users and their applications get access to o/s-secured resources (applications, transactions, etc.) with o/s-level security.
End-users and their applications get access to WMQ resources through MQI calls. Authorizations to these resources are granted (usually to end-user groups) with setmqaut control command or the WMQ Explorer.
If you are now responsible for managing an existing installation, one in which permissions have already been changed, I'd leave bad-enough alone - you can only make things worse. Uninstall and reinstall WMQ.
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live. |
|
| Back to top |
|
|
| issac |
| Posted: Tue Jul 17, 2012 9:40 pm Post subject: |
|
|
Disciple
Joined: 02 Oct 2008
Posts: 158
Location: Shanghai
|
Understood. Thank you very much! 
_________________
Bazinga! |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
