ASG
IBM
Zystems
Cressida
Icon
Netflexity
 
  MQSeries.net
Search  Search       Tech Exchange      Education      Certifications      Library      Info Center      SupportPacs      LinkedIn  Search  Search                                                                   FAQ  FAQ   Usergroups  Usergroups
 
Register  ::  Log in Log in to check your private messages
 
RSS Feed - WebSphere MQ Support RSS Feed - Message Broker Support

MQSeries.net Forum IndexGeneral IBM MQ SupportCHLAUTH Question

Post new topicReply to topic
CHLAUTH Question View previous topic :: View next topic
Author Message
wmbwmq
PostPosted: Wed Mar 24, 2021 4:28 am Post subject: CHLAUTH Question Reply with quote

Acolyte

Joined: 18 Jul 2011
Posts: 66

Howdy,
I am unable to figure out why the NOACCESS is not enforced in the below scenario.
So I have the following CHLAUTH rules set.

CHLAUTH(SYSTEM.*) TYPE(ADDRESSMAP)
ADDRESS(*) USERSRC(NOACCESS)

CHLAUTH(*) TYPE(ADDRESSMAP)
ADDRESS(*) USERSRC(NOACCESS)

CHLAUTH(*) TYPE(BLOCKUSER)
USERLIST(*MQADMIN)

CHLAUTH(SYSTEM.ADMIN.SVRCONN) TYPE(ADDRESSMAP)
ADDRESS(*) USERSRC(NOACCESS)

CHLAUTH(SYSTEM.DEF.SVRCONN) TYPE(ADDRESSMAP)
ADDRESS(*) USERSRC(NOACCESS)

dis chl(SYSTEM.DEF.SVRCONN) mcauser
CHANNEL(SYSTEM.DEF.SVRCONN) CHLTYPE(SVRCONN)
MCAUSER(mqm)

But I am able to connect to the QMGR from MQ explorer using this channel. I thought the CHLAUTH rules above specifically blocks any connection on that channel (at multiple levels, including that USERLIST(*MQADMIN) blocking)?

DISPLAY CHLAUTH ('SYSTEM.DEF.SVRCONN') MATCH (RUNCHECK) ADDRESS('<my-desk-ip>') CLNTUSER('<My-AD-User>')
AMQ8898: Display channel authentication record details - currently disabled.
CHLAUTH(SYSTEM.DEF.SVRCONN) TYPE(ADDRESSMAP)
ADDRESS(*) USERSRC(NOACCESS)

dis chlauth(SYSTEM.DEF.SVRCONN) all
CHLAUTH(SYSTEM.DEF.SVRCONN) TYPE(ADDRESSMAP)
DESCR(Default rule to allow MQ Explorer access)
CUSTOM( ) ADDRESS(*)
USERSRC(NOACCESS) WARN(NO)
ALTDATE(2021-03-23) ALTTIME(14.19.59)


dis chs(SYSTEM.DEF.SVRCONN)
CHANNEL(SYSTEM.DEF.SVRCONN) CHLTYPE(SVRCONN)
CONNAME(<my-desk-ip>) CURRENT
STATUS(RUNNING) SUBSTATE(RECEIVE)

MQ Version: 9.0.0.6

What am I missing?
Back to top
View user's profile Send private message
bruce2359
PostPosted: Wed Mar 24, 2021 5:25 am Post subject: Reply with quote

Poobah

Joined: 05 Jan 2008
Posts: 8892
Location: US: west coast, almost. Otherwise, enroute.

CHLAUTH enabled at qmgr?

You did a refresh security?
_________________
Five out of four people have trouble with fractions. - Steven Wright.
Back to top
View user's profile Send private message
wmbwmq
PostPosted: Wed Mar 24, 2021 6:07 am Post subject: Reply with quote

Acolyte

Joined: 18 Jul 2011
Posts: 66

Oops rookie mistake. This is embarrassing
Someone else disabled chlauth earlier and I missed to check that part.
Thank you Bruce.
Back to top
View user's profile Send private message
bruce2359
PostPosted: Wed Mar 24, 2021 7:44 am Post subject: Reply with quote

Poobah

Joined: 05 Jan 2008
Posts: 8892
Location: US: west coast, almost. Otherwise, enroute.

I wont tell anyone.
_________________
Five out of four people have trouble with fractions. - Steven Wright.
Back to top
View user's profile Send private message
hughson
PostPosted: Mon Mar 29, 2021 12:58 am Post subject: Reply with quote

Padawan

Joined: 09 May 2013
Posts: 1552
Location: Bay of Plenty, New Zealand

wmbwmq wrote:
AMQ8898: Display channel authentication record details - currently disabled.


wmbwmq wrote:
Oops rookie mistake. This is embarrassing
Someone else disabled chlauth earlier and I missed to check that part.
Thank you Bruce.


We knew when we designed CHLAUTH that some people would do this, so we tried to help by outputting the above message, snipped from the output in your initial question. Sigh...
_________________
Morag Hughson @MoragHughson
IBM MQ Technical Education Specialist
Get your IBM MQ training here!
MQGem Software
Back to top
View user's profile Send private message Visit poster's website
Display posts from previous:
Post new topicReply to topic Page 1 of 1

MQSeries.net Forum IndexGeneral IBM MQ SupportCHLAUTH Question
Jump to:



You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Protected by Anti-Spam ACP


Theme by Dustin Baccetti
Powered by phpBB 2001, 2002 phpBB Group

Copyright MQSeries.net. All rights reserved.