| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| Granting restricted MQ access. |
« View previous topic :: View next topic » |
| Author |
Message
|
| mcslackin |
 Posted: Thu Mar 24, 2011 9:49 am Post subject: Granting restricted MQ access. |
 |
|
Newbie
Joined: 24 Mar 2011
Posts: 1
|
Hello,
I need to provide the following privileges to users without giving access to mqm and broker administration. I've thought about dumping a lot of this information to files in a restricted directory but wanted to know if others have set up Mq auth for groups or IDs that would do this. I've also thought about setting up sudo rules but with my limited knowledge there I'm not sure if could all be done.
If this has already been addressed I wasn't able to find the post, could someone direct me to it?
For MQ:
read access to logs under /var/mqm/qmgrs/?????/errors (AMQERR01.LOG, AMQERR02.LOG, AMQERR03.LOG) where ????? = queue manager name
read access to logs under /var/mqm/errors (AMQERR01.LOG, AMQERR02.LOG, AMQERR03.LOG)
display authority under runmqsc command for all MQ objects (qmgr, queues, channels, processes, services) including MQ cluster objects
authority to run commands dspmqver and dspmq
For Broker:
read access to logs at /var/adm/user.log
authority to run mqsilist command to display brokers, execution groups and message flows
authority to run mqsiservice command to display version level
Appreciate it! |
|
| Back to top |
|
 |
| mqjeff |
| Posted: Thu Mar 24, 2011 10:22 am Post subject: |
|
|
Grand Master
Joined: 25 Jun 2008
Posts: 17447
|
I would solve this by creating scripts that perform the relevant tasks, putting them in a known location and ensuring that users can't edit them.
Then I would create sudo rules that allow for users to execute those script files as mqm and broker admin user.
You could also accomplish a fair amount of what you want by creating a set of symlinks (ln -s) to the various logs in another location and then provide read only os level permissions to those symlinks.
You should also review the use of MQExplorer in a read only manner -there's a link to an article around somewhere that discusses this. |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
