ASG
IBM
Zystems
Cressida
Icon
Netflexity
 
  MQSeries.net
Search  Search       Tech Exchange      Education      Certifications      Library      Info Center      SupportPacs      LinkedIn  Search  Search                                                                   FAQ  FAQ   Usergroups  Usergroups
 
Register  ::  Log in Log in to check your private messages
 
RSS Feed - WebSphere MQ Support RSS Feed - Message Broker Support

MQSeries.net Forum Index » IBM MQ Security » WebSphere MQ 8 + SSL + FTE 7.0.4.4 + AMS

Post new topic  Reply to topic
 WebSphere MQ 8 + SSL + FTE 7.0.4.4 + AMS « View previous topic :: View next topic » 
Author Message
xeonix
PostPosted: Mon Aug 11, 2014 5:13 am    Post subject: WebSphere MQ 8 + SSL + FTE 7.0.4.4 + AMS Reply with quote

Apprentice

Joined: 02 Apr 2013
Posts: 32
Greeting, gentlemen.

I need to configure FTE to use AMS in order to encrypt message contents, because in some cases my FTE agents has to transfer unencrypted files.

There are two servers with the same config:
Win 2008 R2, WebSphere MQ 8 (with AMS enabled), WebSphere MQ FTE 7.0.4.4
QMgrs are: QMWAY and QMRIV.0170, each is located on it's own separate server.

Also, there are 2 FTE agents, AGENT_WAY and AGENT_RIV correspondingly.
QMWAY is coordination QMgr and command QMgr for AGENT_WAY, QMRIV.0170 is command QMgr for AGENT_RIV.
QMWAY and AGENT_WAY Windows Services are running under the same account "SVC_MQ_0000", which is member of "mqm" group.
Same with QMRIV.0170 and AGENT_RIV - user is "SVC_MQ_0170"
Both accounts are in MS Active Directory Domain, so there's "Domain mqm" group, and each QMgr is configured to work with AD.
There are monitors to transfer files from AGENT_WAY to AGENT_RIV and backwards - each server has corresponding IN and OUT folders.

File transfers between FTE agents are made using pairs of channels:
QMWAY.TO.QMRIV.0170 (QMWAY, SDR) -> QMWAY.TO.QMRIV.0170 (QMRIV.0170, RVCR)
QMRIV.0170.TO.QMWAY (QMRIV.0170, SDR) -> QMRIV.0170.TO.QMWAY (QMWAY, RVCR)
On each of these channels I have SSL enabled, so MQ traffic goes encrypted, and everything works fine.

According to this manual:
http://www-01.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.sec.doc/q014740_.htm?lang=en
I was trying to configure FTE to use AMS.

I've created 2 key databases, for user "SVC_MQ_0000" and "SVC_MQ_0170" in CMS format with personal certificates:
CN=ibmwebspheremqsvc_mq_0000
and
CN=ibmwebspheremqsvc_mq_0170
accordingly. My CA certificate is loaded to keystores too.
Next, I've exchanged public keys with these 2 CMS kestores. Then exported personal keys to JKS with the CA certificate and public keys as well.

According to manual, I created 2 "keystore.conf" files for each MQ server.

"keystore.conf", that goes to "C:\Users\SVC_MQ_0000\.mqs" on QMWAY's server:
cms.keystore = C:\IBM\keystores\svc_mq_0000\svc_mq_0000
cms.certificate = ibmwebspheremqsvc_mq_0000

jks.keystore=C:/IBM/keystores/svc_mq_0000/svc_mq_0000
jks.certificate=ibmwebspheremqsvc_mq_0000
jks.encrypted=no
jks.keystore_pass=P@ssw0rd
jks.key_pass=P@ssw0rd
jks.provider=IBMJCE

"keystore.conf", that goes to "C:\Users\SVC_MQ_0170\.mqs" on QMRIV.0170's server:
cms.keystore = C:\IBM\keystores\svc_mq_0170\svc_mq_0170
cms.certificate = ibmwebspheremqsvc_mq_0170

jks.keystore=C:/IBM/keystores/svc_mq_0170/svc_mq_0170
jks.certificate=ibmwebspheremqsvc_mq_0170
jks.encrypted=no
jks.keystore_pass=P@ssw0rd
jks.key_pass=P@ssw0rd
jks.provider=IBMJCE

I've also set environment variables and copied "keystore.conf" files to corresponding locations on each server.
QMWAY's server:
MQS_KEYSTORE_CONF=C:\IBM\keystores\svc_mq_0000\keystore.conf
QMRIV.0170's server:
MQS_KEYSTORE_CONF=C:\IBM\keystores\svc_mq_0170\keystore.conf

Next, I've created security policies on each QMGr for "SYSTEM.FTE.DATA.XXX" queues, as said in the manual to encrypt FTE messages:

setmqspl -m QMWAY -p SYSTEM.FTE.DATA.AGENT_WAY -s SHA1 -a "CN=ibmwebspheremqsvc_mq_0000" -a "CN=ibmwebspheremqsvc_mq_0170" -e AES128 -r "CN=ibmwebspheremqsvc_mq_0000" -r "CN=ibmwebspheremqsvc_mq_0170" -t 0

setmqspl -m QMRIV.0170 -p SYSTEM.FTE.DATA.AGENT_RIV -s SHA1 -a "CN=ibmwebspheremqsvc_mq_0170" -a "CN=ibmwebspheremqsvc_mq_0000" -e AES128 -r "CN=ibmwebspheremqsvc_mq_0170" -r "CN=ibmwebspheremqsvc_mq_0000" -t 0

After all these configuration steps I restarted QMgrs and FTE agents. According to FTE agent logs - both agents started successfully. If something went wrong at this step, queues "SYSTEM.FTE.DATA.AGENT_WAY" and "SYSTEM.FTE.DATA.AGENT_RIV" wouldn't be accessible to thier agents.
When I'm trying to transfer files in any direstion, for example from AGENT_WAY to AGENT_RIV - FTE's Transfer Log is populated with entry, constantly saying, that transfer is Starting, but no file actually transferred.
Also, QMgr's DLQ is populated with 2 messages:

00000 44 4C 48 20 01 00 00 00--0F 08 00 00 53 59 53 54 |DLH ........SYST|
00010 45 4D 2E 46 54 45 2E 44--41 54 41 2E 41 47 45 4E |EM.FTE.DATA.AGEN|
00020 54 5F 52 49 56 20 20 20--20 20 20 20 20 20 20 20 |T_RIV |
00030 20 20 20 20 20 20 20 20--20 20 20 20 51 4D 52 49 | QMRI|
00040 56 2E 30 31 37 30 20 20--20 20 20 20 20 20 20 20 |V.0170 |
00050 20 20 20 20 20 20 20 20--20 20 20 20 20 20 20 20 | |
00060 20 20 20 20 20 20 20 20--20 20 20 20 11 01 00 00 | ....|
00070 B5 01 00 00 20 20 20 20--20 20 20 20 0B 00 00 00 |╡... ...|
00080 53 70 68 65 72 65 20 4D--51 5C 62 69 6E 36 34 5C |Sphere MQ\bin64\|
00090 61 6D 71 72 6D 70 70 61--2E 65 78 65 32 30 31 34 |amqrmppa.exe2014|
000A0 30 38 31 31 31 32 32 34--30 34 36 39 4D 51 46 54 |081112240469MQFT|
000B0 58 46 45 52 00 00 00 01--00 00 00 1D FF FF FF FF |XFER.......    |
000C0 01 00 00 00 00 00 00 00--00 00 00 00 |............ |


AND


00000 44 4C 48 20 01 00 00 00--0F 08 00 00 53 59 53 54 |DLH ........SYST|
00010 45 4D 2E 46 54 45 2E 44--41 54 41 2E 41 47 45 4E |EM.FTE.DATA.AGEN|
00020 54 5F 52 49 56 20 20 20--20 20 20 20 20 20 20 20 |T_RIV |
00030 20 20 20 20 20 20 20 20--20 20 20 20 51 4D 52 49 | QMRI|
00040 56 2E 30 31 37 30 20 20--20 20 20 20 20 20 20 20 |V.0170 |
00050 20 20 20 20 20 20 20 20--20 20 20 20 20 20 20 20 | |
00060 20 20 20 20 20 20 20 20--20 20 20 20 11 01 00 00 | ....|
00070 B5 01 00 00 20 20 20 20--20 20 20 20 0B 00 00 00 |╡... ...|
00080 53 70 68 65 72 65 20 4D--51 5C 62 69 6E 36 34 5C |Sphere MQ\bin64\|
00090 61 6D 71 72 6D 70 70 61--2E 65 78 65 32 30 31 34 |amqrmppa.exe2014|
000A0 30 38 31 31 31 32 32 34--30 34 38 38 4D 51 46 54 |081112240488MQFT|
000B0 58 46 45 52 00 00 00 01--00 00 00 35 00 00 00 18 |XFER.......5....|
000C0 41 4D 51 20 51 4D 57 41--59 20 20 20 20 20 20 20 |AMQ QMWAY |
000D0 30 42 E2 53 21 7E 74 05--00 00 00 00 00 00 00 00 |0BΓS!~t.........|
000E0 00 00 00 00 00 01 00 00--00 02 00 00 00 00 FF FF |..............  |
000F0 FF FF FF FF FF FF 00 00--00 2D 00 00 66 69 6C 65 |      ...-..file|
00100 2E 6C 61 73 74 2E 6D 6F--64 69 66 69 65 64 3D 31 |.last.modified=1|
00110 34 30 37 37 35 39 38 30--39 32 39 37 20 66 69 6C |407759809297 fil|
00120 65 2E 73 69 7A 65 3D 31--34 00 00 00 00 00 00 00 |e.size=14.......|
00130 00 00 00 00 00 00 00 00--0E 01 00 48 65 6C 6C 6F |...........Hello|
00140 20 46 54 45 20 41 4D 53--21 00 00 00 00 00 00 00 | FTE AMS!.......|
00150 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00160 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00170 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00180 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00190 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
001A0 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
001B0 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
001C0 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
001D0 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
001E0 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
001F0 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00200 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00210 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00220 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00230 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00240 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00250 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00260 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00270 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00280 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00290 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
002A0 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
002B0 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
002C0 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
002D0 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
002E0 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
002F0 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00300 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00310 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00320 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00330 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00340 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00350 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00360 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00370 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00380 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
00390 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
003A0 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
003B0 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
003C0 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
003D0 00 00 00 00 00 00 00 00--00 00 00 00 00 00 00 00 |................|
003E0 00 00 00 00 00 00 00 00-- |........ |

For some reason message contents appears to be decrypted but destination FTE agent is unable to receive file.
I've disabled SSL on MQ SDR and RCVR channels, retried transfer and inspected traffic at TCP port 1414 using wireshark - inside network packets I can clearly see my transferring file data "Hello FTE AMS!" which means, that FTE dosen't encrypt data it transfers anyway.

Then I decided to stop both FTE agents, log on at QMWAY's server as "SVC_MQ_0000", connect to QMgr QMRIV.0170 via MQ Explorer and to put test message to queue "SYSTEM.FTE.DATA.AGENT_RIV".
At QMRIV.0170's server I logged in as "SVC_MQ_0170" and browsed queue "SYSTEM.FTE.DATA.AGENT_RIV" - my test message is there and it's decrypted.
According to manuals I created alias queue, which is pointing to "SYSTEM.FTE.DATA.AGENT_RIV", then logged out, and logged in as Administrator.
Now I'm not able to browse "SYSTEM.FTE.DATA.AGENT_RIV", which is expected behavior. I've browsed alias queue, that I previously created, and yes, I see encrypted message as well as digital signature.
So AMS works fine, MQ Explorer too, but FTE dosen't.

What am I missing, how to enable AMS at FTE agent?
Please help
Back to top
View user's profile Send private message
fjb_saper
PostPosted: Mon Aug 11, 2014 5:45 am    Post subject: Reply with quote

Grand High Poobah

Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
The policies MUST match on both ends... yours don't!.
_________________
MQ & Broker admin
Back to top
View user's profile Send private message Send e-mail
xeonix
PostPosted: Mon Aug 11, 2014 6:01 am    Post subject: Reply with quote

Apprentice

Joined: 02 Apr 2013
Posts: 32
fjb_saper wrote:
The policies MUST match on both ends... yours don't!.


setmqspl -m QMWAY -p SYSTEM.FTE.DATA.AGENT_WAY -s SHA1 -a "CN=ibmwebspheremqsvc_mq_0000" -a "CN=ibmwebspheremqsvc_mq_0170" -e AES128 -r "CN=ibmwebspheremqsvc_mq_0000" -r "CN=ibmwebspheremqsvc_mq_0170" -t 0

setmqspl -m QMRIV.0170 -p SYSTEM.FTE.DATA.AGENT_RIV -s SHA1 -a "CN=ibmwebspheremqsvc_mq_0170" -a "CN=ibmwebspheremqsvc_mq_0000" -e AES128 -r "CN=ibmwebspheremqsvc_mq_0170" -r "CN=ibmwebspheremqsvc_mq_0000" -t 0

Yes, policies are different, because queues are different:
on QMgr "QMWAY" FTE agent's data queue is "SYSTEM.FTE.DATA.AGENT_WAY"
on QMgr "QMRIV.0170" FTE agent's data queue is "SYSTEM.FTE.DATA.AGENT_RIV"

Everything else is the same, including "Message signing algorithm" (-s SHA1), "Message encryption algorithm" (-e AES128), "Distinguished names of permitted message originators" (-a) and "Distinguished names of permitted message recipients" (-r).

As far as I know, policy name should match the name of the queue it protects on the QMgr.
Should I create on QMWAY policy "SYSTEM.FTE.DATA.AGENT_RIV", in addition to existing "SYSTEM.FTE.DATA.AGENT_WAY",
and "SYSTEM.FTE.DATA.AGENT_WAY" on QMRIV.0170 in addition to existing "SYSTEM.FTE.DATA.AGENT_RIV"?
Can you provide a bit detailed explanation?
Back to top
View user's profile Send private message
fjb_saper
PostPosted: Mon Aug 11, 2014 6:28 am    Post subject: Reply with quote

Grand High Poobah

Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
Yes you should.
The sending queue and receiving queue need to have the same policies.
So if 2 qmgrs are involved, you need the same policy on each end of the communication. Specially with toleration set to no/false
_________________
MQ & Broker admin
Back to top
View user's profile Send private message Send e-mail
xeonix
PostPosted: Mon Aug 11, 2014 7:17 am    Post subject: Reply with quote

Apprentice

Joined: 02 Apr 2013
Posts: 32
fjb_saper wrote:
Yes you should.
The sending queue and receiving queue need to have the same policies.
So if 2 qmgrs are involved, you need the same policy on each end of the communication. Specially with toleration set to no/false

God bless you, man, it works!
I have one more thing to ask.

WireShark show me, that message is signed and encrypted, while putting it to QMRIV.0170's queue "SYSTEM.FTE.DATA.AGENT_RIV". I can see root CA key inside network packet (***-***-DC-CA).



Excellent, but there's packet, coming next, from QMRIV.0170 back to QMWAY's "SYSTEM.FTE.COMMAND.AGENT_WAY" queue. It contains my test file's unencrypted contents:



Does that mean, I should create additional policies for queues "SYSTEM.FTE.COMMAND.***" just like I did for "SYSTEM.FTE.DATA.***"?
Or maybe a better way would be to protect XMIT queues?
Back to top
View user's profile Send private message
fjb_saper
PostPosted: Mon Aug 11, 2014 7:35 am    Post subject: Reply with quote

Grand High Poobah

Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
I'd expect you need to verify that you specified an encryption policy and not just a signing policy on your data outbound queue.
Remember if you change the policy to change it at both ends...

Also think about where you are setting up your wireshark. Is it really looking at comms between the qmgrs or at coms between qmgr and client or at coms between MQ client and MQ app...??
_________________
MQ & Broker admin
Back to top
View user's profile Send private message Send e-mail
xeonix
PostPosted: Mon Aug 11, 2014 11:55 pm    Post subject: Reply with quote

Apprentice

Joined: 02 Apr 2013
Posts: 32
fjb_saper wrote:
I'd expect you need to verify that you specified an encryption policy and not just a signing policy on your data outbound queue.
Remember if you change the policy to change it at both ends...

Also think about where you are setting up your wireshark. Is it really looking at comms between the qmgrs or at coms between qmgr and client or at coms between MQ client and MQ app...??

Well, I didn't change anything, policies are the same at both ends, here's output of "dspmqspl -export":

setmqspl -m QMWAY -p SYSTEM.FTE.DATA.AGENT_RIV -s SHA1 -a "CN=ibmwebspheremqsvc_mq_0000" -a "CN=ibmwebspheremqsvc_mq_0170" -e AES128 -r "CN=ibmwebspheremqsvc_mq_0000" -r "CN=ibmwebspheremqsvc_mq_0170" -t 0
setmqspl -m QMWAY -p SYSTEM.FTE.DATA.AGENT_WAY -s SHA1 -a "CN=ibmwebspheremqsvc_mq_0000" -a "CN=ibmwebspheremqsvc_mq_0170" -e AES128 -r "CN=ibmwebspheremqsvc_mq_0000" -r "CN=ibmwebspheremqsvc_mq_0170" -t 0

setmqspl -m QMRIV.0170 -p SYSTEM.FTE.DATA.AGENT_RIV -s SHA1 -a "CN=ibmwebspheremqsvc_mq_0170" -a "CN=ibmwebspheremqsvc_mq_0000" -e AES128 -r "CN=ibmwebspheremqsvc_mq_0170" -r "CN=ibmwebspheremqsvc_mq_0000" -t 0
setmqspl -m QMRIV.0170 -p SYSTEM.FTE.DATA.AGENT_WAY -s SHA1 -a "CN=ibmwebspheremqsvc_mq_0170" -a "CN=ibmwebspheremqsvc_mq_0000" -e AES128 -r "CN=ibmwebspheremqsvc_mq_0170" -r "CN=ibmwebspheremqsvc_mq_0000" -t 0

As you can see, in addition to signing (-s), encryption is specified with argument "-e".

When I transfer files from AGENT_WAY to AGENT_RIV, WireShark is showing me, that message content is really signed & encrypted, when it goes to QMRIV.0170's "SYSTEM.FTE.DATA.AGENT_RIV" queue. Why file contents are sent back from QMRIV.0170 to QMWAY's "SYSTEM.FTE.COMMAND.AGENT_WAY" queue unencrypted?
BTW, WireShark is installed at QMWAY's server, it that maters. It monitors network traffic of the network connection, filtering packets by specific port (in my case - it's MQ's default TCP 1414).
Back to top
View user's profile Send private message
fjb_saper
PostPosted: Tue Aug 12, 2014 4:42 am    Post subject: Reply with quote

Grand High Poobah

Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
So which traffic are you intercepting with wireshark?
qmgr to qmgr?
qmgr to client?
Remember that qmgr to client should be SSL.

Have fun
_________________
MQ & Broker admin
Back to top
View user's profile Send private message Send e-mail
smdavies99
PostPosted: Tue Aug 12, 2014 5:31 am    Post subject: Reply with quote

Jedi Council

Joined: 10 Feb 2003
Posts: 6076
Location: Somewhere over the Rainbow this side of Never-never land.
To backup what my colleague has posted before me, IMHO it would be better to separate the QMGR-->QMGR and the QMGR-->Client connections.

Create another listener on a different port and change the one of the connectinos to use that port. Then your wireshark capture will only get the traffic you are interested in.

Then you can be really, really sure of what you are seeing.
_________________
WMQ User since 1999
MQSI/WBI/WMB/'Thingy' User since 2002
Linux user since 1995

Every time you reinvent the wheel the more square it gets (anon). If in doubt think and investigate before you ask silly questions.
Back to top
View user's profile Send private message
xeonix
PostPosted: Wed Aug 13, 2014 12:01 am    Post subject: Reply with quote

Apprentice

Joined: 02 Apr 2013
Posts: 32
fjb_saper wrote:
So which traffic are you intercepting with wireshark?
qmgr to qmgr?
qmgr to client?
Remember that qmgr to client should be SSL.

Have fun


smdavies99 wrote:
To backup what my colleague has posted before me, IMHO it would be better to separate the QMGR-->QMGR and the QMGR-->Client connections.

Create another listener on a different port and change the one of the connections to use that port. Then your wireshark capture will only get the traffic you are interested in.

Then you can be really, really sure of what you are seeing.


In my configuration MQ and FTE are installed on the same machine. Each FTE Agent connects to it's own command QMgr in bindings mode. Also, FTE "AGENT_RIV" is connected in client mode to coordination QMgr "QMWAY", while "AGENT_WAY" is using bindings.

As far as I can tell, when I transfer files from one FTE Agent to another - data is transferred between QMgrs, using pairs of SRD->RCVR channel in both directions (QMGR to QMGR connection).
Client to QMgr connections are made only from remote FTE agents to coordination QMgr.
Correct me please, if I wrong somewhere.

In order to check whether AMS works or not, I disabled SSL on each pair of channels SRD->RCVR.
In this case I can verify if message content is encrypted using AMS or not, by watching network traffic. If not - I should be able to see string "Hello FTE AMS!" in captured network traffic. Otherwise - I should see encrypted file contents, containing digital signature (screenshot 1).

Anyway, I don't care about what type of connection is made, I'm just listening network traffic on TCP 1414 port between 2 servers, when file is transferring from one FTE agent to another, and looking for network packets containing unencrypted file contents "Hello FTE AMS!" (as I highlighted in screenshots).

According to manual - the only queues I need to protect with Security Policy are "SYSTEM.FTE.DATA.***" to encrypt message content. However, WireShark shows me - that's not enough.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic  Reply to topic Page 1 of 1

MQSeries.net Forum Index » IBM MQ Security » WebSphere MQ 8 + SSL + FTE 7.0.4.4 + AMS
Jump to:  



You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Protected by Anti-Spam ACP
  
 


Theme by Dustin Baccetti
Powered by phpBB © 2001, 2002 phpBB Group

Copyright © MQSeries.net. All rights reserved.