| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| Microsoft Management Counsel |
View previous topic :: View next topic |
| Author |
Message
|
| Bill57 |
 Posted: Mon Nov 18, 2002 2:07 pm Post subject: Microsoft Management Counsel |
 |
|
Apprentice
Joined: 26 Jul 2002
Posts: 35
Location: Atlanta, GA
|
This question may have as much to do with configuring the Microsoft Management Counsel (MMC), as configuring MQ, so I’m posting it here.
Basically this is a security issue. To administer a remote queue manager using the MMC, you have to define a channel called SYSTEM.ADMIN.SVRCONN. Because it is a well known channel, anyone who can get into the MQ environment can do so under the user ID mqm, and thus have complete administrative control over your queue manager (contact admin business).
Now, I could write a rather simple security exit that asks for a user Id and password combination. That would go a long way in authenticating the connecting application as “trusted”.
What I would rather do (at least in the short run) is configure the MMC to use a channel name of my choice rather than the SYSTEM.ADMIN.SVRCONN channel. That way, I can define a rather cryptic, hard to guess SVRCONN channel, and be fairly secure, quick and easy.
The problem is I don’t see anything in the help stuff that says how you can change that value.
Any Ideas?….. the registry maybe??
_________________
Bill Anderson
MQSeries Developer |
|
| Back to top |
|
 |
| kolban |
| Posted: Mon Nov 18, 2002 7:51 pm Post subject: |
|
|
Grand Master
Joined: 22 May 2001
Posts: 1072
Location: Fort Worth, TX, USA
|
Unfortunately, it is a not a configurable item. I would claim that the lack of a little knowledge does little to protect a system.
IBM's policy on this topic is to use a pair of security exits. See the following for samples:
http://www.kolban.com/mq/Security/security.htm |
|
| Back to top |
|
|
| Bill57 |
| Posted: Tue Nov 19, 2002 3:51 pm Post subject: |
|
|
Apprentice
Joined: 26 Jul 2002
Posts: 35
Location: Atlanta, GA
|
Thanks for the link, it looks very similar to what I am considering writting myself (if I just had the damn time). The problem using it is the remote queue manager in question is running on an AIX box.
I refuse to accept the security risk, so, I guess I'm doing the "runmqsc thing" until I work something out.
Thanks again for the info, it was usefull
Bill
_________________
Bill Anderson
MQSeries Developer |
|
| Back to top |
|
|
|
|
|
|
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
