Limiting RUNMQSC authority for certain users - Middleware News
You want to provide limited access to RUNMQSC for non-mqm users. You want to make sure that they can only DISPLAY information about a queue manager and the queue manager's objects.
Cause
WebSphere MQ is configured so that only "mqm" users can use runmqsc. The runmqsc program is shipped with the following permission settings:
-r-sr-s--- 1 mqm mqm
Resolving the problem
Create a non mqm user
setmqaut -m -t qmgr -p +dsp +connect
Create a copy of runmqsc with execute permission set to all. When the permissions are changed to -r-sr-sr-x this means any user can run runmqsc but when it runs, it runs as user mqm, group mqm due to the Set-user-ID-on-execution and Set-group-ID-on-execution permissions.
cd /var/mqm/qmgrs//@ipcc
chmod +r AMQCLCHL.TAB
chmod +r AMQRFCDA.DAT
You want to provide limited access to RUNMQSC for non-mqm users. You want to make sure that they can only DISPLAY information about a queue manager and the queue manager's objects.
Cause
WebSphere MQ is configured so that only "mqm" users can use runmqsc. The runmqsc program is shipped with the following permission settings:
-r-sr-s--- 1 mqm mqm
Resolving the problem
Create a non mqm user
setmqaut -m
Create a copy of runmqsc with execute permission set to all. When the permissions are changed to -r-sr-sr-x this means any user can run runmqsc but when it runs, it runs as user mqm, group mqm due to the Set-user-ID-on-execution and Set-group-ID-on-execution permissions.
cd /var/mqm/qmgrs/
chmod +r AMQCLCHL.TAB
chmod +r AMQRFCDA.DAT
If you do this, you are giving full MQ admin rights to everybody. Watch out from whom you're taking advice, esp. online.
ReplyDelete@Karthick: you shouldn't be volunteering advice if you don't know your ass from a hole in the ground.