| Author |
Message
|
| pintrader |
 Posted: Tue Jul 29, 2014 8:24 pm Post subject: Default channel permission |
 |
|
Disciple
Joined: 22 Jan 2014
Posts: 164
|
Hi
Just want to check with you, after defining channels eg
define channel(channelname) chltype(svrconn) .......
Is it by default "allow all" permission to this channel? Or do we have to use set chlauth to define all are allowed?
I just want to allow all users to connect to this channel and use all MQ objects.
thanks |
|
| Back to top |
|
 |
| bruce2359 |
| Posted: Tue Jul 29, 2014 8:36 pm Post subject: |
|
|
Poobah
Joined: 05 Jan 2008
Posts: 9469
Location: US: west coast, almost. Otherwise, enroute.
|
Which mq version?
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live. |
|
| Back to top |
|
|
| pintrader |
| Posted: Tue Jul 29, 2014 9:08 pm Post subject: |
|
|
Disciple
Joined: 22 Jan 2014
Posts: 164
|
| bruce2359 wrote: |
| Which mq version? |
hi
MQ7.5.0.3
thanks |
|
| Back to top |
|
|
| smdavies99 |
| Posted: Wed Jul 30, 2014 12:17 am Post subject: Re: Default channel permission |
|
|
Jedi Council
Joined: 10 Feb 2003
Posts: 6076
Location: Somewhere over the Rainbow this side of Never-never land.
|
| pintrader wrote: |
I just want to allow all users to connect to this channel and use all MQ objects.
|
IMHO, that is not security, that 'Insecurity'.
The defaults are usually to allow nothing especially if you have applied the 'Back stop' rule as discussed here many times.
If you really want to give users total freedom and as log as you are aware of the risks then go ahead.
_________________
WMQ User since 1999
MQSI/WBI/WMB/'Thingy' User since 2002
Linux user since 1995
Every time you reinvent the wheel the more square it gets (anon). If in doubt think and investigate before you ask silly questions. |
|
| Back to top |
|
|
| pintrader |
| Posted: Wed Jul 30, 2014 1:40 am Post subject: Re: Default channel permission |
|
|
Disciple
Joined: 22 Jan 2014
Posts: 164
|
| smdavies99 wrote: |
IMHO, that is not security, that 'Insecurity'.
|
yes, thanks. I perfectly understand this. This channel will only be temporary.
| smdavies99 wrote: |
The defaults are usually to allow nothing especially if you have applied the 'Back stop' rule as discussed here many times.
If you really want to give users total freedom and as log as you are aware of the risks then go ahead. |
ok, so i just define the channel as it is, and all will be allowed right (ie, i do not have to use set chlauth.) ? thanks |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Wed Jul 30, 2014 4:34 am Post subject: Re: Default channel permission |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
[quote="pintrader"]
| smdavies99 wrote: |
ok, so i just define the channel as it is, and all will be allowed right (ie, i do not have to use set chlauth.) ? thanks |
That used to be the behavior before 7.1 and channel auth.
The default channel auth rule will prevent admin through any server connection channel. Any body else needs to have access defined at least at the OAM level...
To allow admin access you need to create another chlauth rule at a minimum. Ideally you'd create multiple (relax admin, backstop any ip, allow user x at ip y) and / or add SSL.
Have fun 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| JosephGramig |
| Posted: Wed Jul 30, 2014 6:59 am Post subject: Re: Default channel permission |
|
|
Grand Master
Joined: 09 Feb 2006
Posts: 1244
Location: Gold Coast of Florida, USA
|
| pintrader wrote: |
| Is it by default "allow all" permission to this channel? Or do we have to use set chlauth to define all are allowed? |
Not exactly. If this is a new install or newly created Qmgr at MQ 7.1 and up, then CHLAUTH rules are on by default (plz don't turn them off). You will have three CHLAUTH rules by default:
- One to block use of any channel that starts with SYSTEM.
- One to allow use of SYSTEM.ADMIN.SVRCONN as the ID that the user passes
- One to block use of any SVRCONN by an administrator ID or one in the mqm group
So create an ID that is not in the mqm group or an administrator, grant it the rights you want and put that in the MCAUSER on the channel. None of this is a good idea, but... |
|
| Back to top |
|
|
|
|
