IBM Websphere Message Broker: Security requirements for Linux and UNIX platforms - Middleware News

View a summary of the authorizations in a Linux or UNIX environment.

You must add the required user IDs to the appropriate group to enable them to complete the relevant tasks.

Note: If you have enabled broker administration security, you must also set up the authority detailed inTasks and authorizations for administration security.

Task	Command	Authorization
Create, delete or migrate a broker	mqsicreatebroker mqsideletebroker mqsimigratecomponents	Member of mqbrkrs and mqm. Using LDAP: Ensure that the registry is appropriately secured to prevent unauthorized access. The setting of LdapPrincipal andLdapCredentials parameters onmqsichangebroker is not required for correct operation of the broker. The password is not stored in clear text in the file system.
Change a broker	mqsichangebroker	Member of mqbrkrs. If you specify the -s parameter to activate broker administration security, the user ID used to run this command must be a member of the mqm group, because several queues are created for use by the broker. Using LDAP: Ensure that the registry is appropriately secured to prevent unauthorized access. The setting of LdapPrincipal andLdapCredentials parameters onmqsichangebroker is not required for correct operation of the broker. The password is not stored in clear text in the file system.
Add or remove a broker instance	mqsiaddbrokerinstance mqsiremovebrokerinstance	Member of mqbrkrs and mqm. Additionally, you need to make the uid and gid for this user ID the same on all the systems, and the user ID needs to be the same one that created the first instance of the multi-instance broker, using themqsicreatebroker command. Change the uid andgid with caution, as it affects the permission levels of files on the system. Changing a uid orgid causes the ownership of all the files previously owned by that user or group to change to the integer of the previous owner of the file. Therefore, you must ensure that your system administrator manually restores the ownerships of the affected files and directories.
Backup or restore a broker	mqsibackupbroker mqsirestorebroker	Member of mqbrkrs.
Start a broker, or verify a broker	mqsistart mqsicvp	Member of mqbrkrs. Member of mqm if the queue manager is not already running.
Stop a broker	mqsistop	Member of mqbrkrs. However, the root user ID can stop a broker without membership ofmqbrkrs. The user ID must be the same as the user ID that started the broker. Member of mqm if -q is specified.
Create or delete an execution group	mqsicreateexecutiongroup mqsideleteexecutiongroup	Member of mqbrkrs. If broker administration security is active, the user ID that runs this command must be a member of the group mqm. If you do not want your broker to run with mqm authority, you must work with yourWebSphere® MQ administrator to create or delete the appropriate authority queue when you create or delete an execution group.
Start or stop a message flow	mqsistartmsgflow mqsistopmsgflow	Member of mqbrkrs.
Create or delete a configurable service	mqsicreateconfigurableservice mqsideleteconfigurableservice	Member of mqbrkrs.
List brokers	mqsilist	Member of mqbrkrs.
Show broker properties	mqsireportbroker mqsireportproperties mqsireportflowmonitoring mqsireportflowstats mqsireportflowuserexits mqsireportresourcestats	Member of mqbrkrs.
Change properties	mqsichangeproperties mqsichangeflowmonitoring mqsichangeflowstats mqsichangeflowuserexits mqsichangeresourcestats	Member of mqbrkrs.
Set and update passwords	mqsisetdbparms	Member of mqbrkrs.
Report or update a broker mode	mqsimode	Member of mqbrkrs.
Deploy an object to a broker	mqsideploy	Member of mqbrkrs.
Reload a broker, execution groups or security	mqsireload mqsireloadsecurity	Member of mqbrkrs.
Trace a broker	mqsichangetrace mqsireporttrace mqsireadlog mqsiformatlog	Member of mqbrkrs.
Set up symbolic links needed for coordinated transactions	mqsimanagexalinks	Root user.
Add the mqbrkrsgroup	mqsisetsecurity	Root user.
Global cache administration	mqsicacheadmin	Member of mqbrkrs.
Package a BAR file	mqsipackagebar	Member of mqbrkrs. The user ID must have WRITEaccess to the -w (root location),-a (BAR file location), and -v(trace file location) directories.
Create or modify a web user account	mqsiwebuseradmin	Member of mqbrkrs.

User is...1	Command Used	Local domain (WORKSTATION)
Running a broker (WebSphere MQ non-trusted application) (login ID).	Not applicable	Member of mqbrkrs. The broker runs under the login ID that started it.
Running a broker (WebSphere MQ trusted application) (login ID).	Not applicable	Login ID must be mqm. mqm must be a member of mqbrkrs.

Ensure that mqbrkrs has access to all user-defined queues that you have defined for use by your message flows. You can use the setmqaut command to set permissions.

• Set the following permissions on all input queues:

  setmqaut -m MB8BROKER -n TEST_INPUT -t queue -g mqbrkrs  +get +inq

• Set the following permissions on all output queues:

  setmqaut -m MB8BROKER -n TEST_OUTPUT -t queue -g mqbrkrs +put +inq +setall

• You might also need to add +passid +passall +setid +setall, depending on your requirements.