| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| AUTHREC Question(MQ V8.0.0.2) |
« View previous topic :: View next topic » |
| Author |
Message
|
| smdavies99 |
 Posted: Thu Apr 23, 2015 3:57 am Post subject: AUTHREC Question(MQ V8.0.0.2) |
 |
|
Jedi Council
Joined: 10 Feb 2003
Posts: 6076
Location: Somewhere over the Rainbow this side of Never-never land.
|
I have a queue manager that is Clustered on a pair of Windows Servers (with MSCS)
If I define a local queue called TEST.IN and specifically auth it for a domain user I can see the following records.
| Code: |
dis authrec objtype(QUEUE) profile (TEST.IN)
19 : dis authrec objtype(QUEUE) profile (TEST.IN)
AMQ8864: Display authority record details.
PROFILE(TEST.IN) ENTITY(administrator@XXX-DEMO)
ENTTYPE(PRINCIPAL) OBJTYPE(QUEUE)
AUTHLIST(BROWSE,CHG,CLR,DLT,DSP,GET,INQ,PUT,PASSALL,PASSID,SET,SETALL,SETID)
AMQ8864: Display authority record details.
PROFILE(TEST.IN) ENTITY(mqm@INT01)
ENTTYPE(GROUP) OBJTYPE(QUEUE)
AUTHLIST(BROWSE,CHG,CLR,DLT,DSP,GET,INQ,PUT,PASSALL,PASSID,SET,SETALL,SETID)
AMQ8864: Display authority record details.
PROFILE(TEST.IN) ENTITY(myuser@XXX-DEMO)
ENTTYPE(PRINCIPAL) OBJTYPE(QUEUE)
AUTHLIST(BROWSE,CLR,DSP,GET,INQ,PUT)
|
If I fail over the QMGR to the other node and display the authrec for that object again I see this.
| Code: |
dis authrec objtype(QUEUE) PROFILE('TEST.IN')
1 : dis authrec objtype(QUEUE) PROFILE('TEST.IN')
AMQ8864: Display authority record details.
PROFILE(TEST.IN) ENTITY(administrator@XXX-DEMO)
ENTTYPE(PRINCIPAL) OBJTYPE(QUEUE)
AUTHLIST(BROWSE,CHG,CLR,DLT,DSP,GET,INQ,PUT,PASSALL,PASSID,SET,SETALL,SETID)
AMQ8864: Display authority record details.
PROFILE(TEST.IN)
ENTITY(S-1-5-21-1287421938-2882423402-1750416858-1008)
ENTTYPE(UNKNOWN) OBJTYPE(QUEUE)
AUTHLIST(BROWSE,CHG,CLR,DLT,DSP,GET,INQ,PUT,PASSALL,PASSID,SET,SETALL,SETID)
AMQ8864: Display authority record details.
PROFILE(TEST.IN) ENTITY(myuser@XXX-DEMO)
ENTTYPE(PRINCIPAL) OBJTYPE(QUEUE)
AUTHLIST(BROWSE,CLR,DSP,GET,INQ,PUT)
|
The auth for the local 'mqm' group has now gone and is replaced by the UID (S-1-5...)
My question is
- How can we enable the auth for the local mqm group on the second server? does this mean that connections from applications on the second server that are running with a group that is part of 'mqm' will not connect?
- do we have to define it manually with the QMGR running on the second server
- or is there a better way to do this.
my reason for asking is that we are trying to lock down our queue managers when we move to V8 and I'm trying to produce some guidelines for securing them.
_________________
WMQ User since 1999
MQSI/WBI/WMB/'Thingy' User since 2002
Linux user since 1995
Every time you reinvent the wheel the more square it gets (anon). If in doubt think and investigate before you ask silly questions. |
|
| Back to top |
|
 |
| fjb_saper |
| Posted: Thu Apr 23, 2015 5:19 am Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
You need to stick to domain users and domain groups for security and administration.
Don't use anything local as the SID of mqm@box1 is different from the SID of mqm@box2...
The only entry in the local mqm group should be "Domain mqm@<domain>" or equivalent...
Have fun 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| smdavies99 |
| Posted: Thu Apr 23, 2015 5:26 am Post subject: |
|
|
Jedi Council
Joined: 10 Feb 2003
Posts: 6076
Location: Somewhere over the Rainbow this side of Never-never land.
|
As the mqm@INT01 record gets defined automatically what do you suggest to overcome it?
Because the local mqm group does not have access to the object on the second node could not run into issues where the user is a member of 'domain mqm' and has not had specific auths for each object?
The only members of the local MQM group are 'domain mqm' and optionally 'domain mb'.
_________________
WMQ User since 1999
MQSI/WBI/WMB/'Thingy' User since 2002
Linux user since 1995
Every time you reinvent the wheel the more square it gets (anon). If in doubt think and investigate before you ask silly questions. |
|
| Back to top |
|
|
| mqjeff |
| Posted: Thu Apr 23, 2015 5:29 am Post subject: |
|
|
Grand Master
Joined: 25 Jun 2008
Posts: 17447
|
| the local mqm user should always have local mqm access... |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Thu Apr 23, 2015 5:32 am Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
| smdavies99 wrote: |
As the mqm@INT01 record gets defined automatically what do you suggest to overcome it?
Because the local mqm group does not have access to the object on the second node could not run into issues where the user is a member of 'domain mqm' and has not had specific auths for each object?
The only members of the local MQM group are 'domain mqm' and optionally 'domain mb'. |
Just to make sure I understood correctly, your MQ Service account is a domain account, member of Domain mqm right? And the service account has query rights to the domain about group membership? Does the domain have cross trust for the machines in the domain?
If the domain mqm, or domain accouts is/are the only member of the local mqm account, you can forget that entry. Just make sure that the content/members of the local mqm group are kept in sync. The easiest way to do that is to allow only domain group accounts into the local mqm group. The local mqm group may well appear on every object created while on that box. This way you can track which box was active when a specific object was created...
_________________
MQ & Broker admin |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
