| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| BlockIP2 userids question |
« View previous topic :: View next topic » |
| Author |
Message
|
| alexf400 |
 Posted: Tue Aug 12, 2014 11:37 pm Post subject: BlockIP2 userids question |
 |
|
Newbie
Joined: 10 Apr 2014
Posts: 8
|
Hi
I want to allow 3 userids from a single server access to a SVRCONN, with an MCAuser set.
Am I allowed to do this?
CON=servername;user1,user2,user3;MCA=mquser;
or do I have to use Patterns and Userids?
The manual implies that the CON statement can have userids, but also that concatenation is handled by Patterns.
Thanks for any help. |
|
| Back to top |
|
 |
| zpat |
| Posted: Tue Aug 12, 2014 11:44 pm Post subject: |
|
|
Jedi Council
Joined: 19 May 2001
Posts: 5866
Location: UK
|
Easy enough to try it.
Your list will work as you have coded it.
Each id in the list can be a pattern or just a single userid.
_________________
Well, I don't think there is any question about it. It can only be attributable to human error. This sort of thing has cropped up before, and it has always been due to human error. |
|
| Back to top |
|
|
| alexf400 |
| Posted: Wed Aug 13, 2014 3:13 am Post subject: |
|
|
Newbie
Joined: 10 Apr 2014
Posts: 8
|
Thanks
looks like I'm only constrained to the 79 characters allowed in the CON= statement.
If I do have to do a longer user list and use the Patterns= and Users= commands, can I specify the MCA User? Or do I just have to set the MCA User on the SVRCONN channel? |
|
| Back to top |
|
|
| zpat |
| Posted: Wed Aug 13, 2014 3:42 am Post subject: |
|
|
Jedi Council
Joined: 19 May 2001
Posts: 5866
Location: UK
|
You can always have multiple statements for the same servername.
BlockIP2 will keep processing rules until it sets the MCA (or runs out of rules).
The MCAUSER on the SVRCONN channel definition should be set to a dummy value (such as NoBody).
In addition your very last BlockIP2 rule should be a catch-all such as this
CON=*;*;MCA=*;
This allows users to keep the id passed in, if not otherwise mapped or blocked in previous rules.
For example I use a rule like this to prevent use of admin ids for client connections (and block blank ids unless previously mapped).
CON=*;mq*,root,qpasa*,wmb*,mqsi*;BLOCK;
CON=*;BLANK_USERID;BLOCK;
_________________
Well, I don't think there is any question about it. It can only be attributable to human error. This sort of thing has cropped up before, and it has always been due to human error. |
|
| Back to top |
|
|
| alexf400 |
| Posted: Wed Aug 13, 2014 5:45 am Post subject: |
|
|
Newbie
Joined: 10 Apr 2014
Posts: 8
|
| That's great, thanks for your help! |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
