I have to agree with Rao. A client who I support back in NYC called to say their QMGR was having problems. NO WONDER. Some admin with ROOT went in and renamed the /var/mqm directory right out from under a running QMGR.
bobbee
From: "Adiraju, Rao" <[EMAIL PROTECTED]> Reply-To: MQSeries List <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: Re: Locking down MQ files/registry on Windows Date: Thu, 11 Mar 2004 09:18:02 +1300
Rob
Even I was looking for a silver-bullet solution earlier in this regard.
But your response raised a curious question - if you are NOT hosting QMgrs on Windows for the fear of "maverick" (I call them as Cow-boys) administrators where do you host your QMGrs then. It will be the same case in UNIX world and as well as z/OS (One could hope for lesser of that category in z/OS). Those who got authority to logon as "root" users on any unix platform also can do anything they want on the MQSeries. Once in one of our SUN boxes, somehow, who lost the entire MQ log directory - what else one can do in these situations.
Giving the due credit to them is a good starting point. Accepting that no responsible employee will cut the corners unless it was Ok with their line manager. If the line managers are different for MQ admins and Window admins, my suggestion is to articulate clearly the roles and responsibilities and escalate any violations to the senior management.
Cheers
Rao
-----Original Message----- From: Wyatt, T. Rob [mailto:[EMAIL PROTECTED] Sent: 11 March 2004 4:34 AM To: [EMAIL PROTECTED] Subject: Re: Locking down MQ files/registry on Windows
Gary,
This is not a very constructive response but I thought I'd share the experience. That very problem is why we don't host Production QMgrs on Windows. We started looking into how to secure it and somewhere along the way we realized that the configurations necessary and the restrictions we placed on the local admin group were so far out of a standard build that it would be extremely difficult to replicate reliably across many servers. So for us the question was not whether the solution was possible but rather whether it was maintainable. From a technical perspective it looked possible (we abandoned the effort before this question was fully answered). From a business perspective it just wasn't cost effective.
-- T.Rob
-----Original Message----- From: Gary Ward [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 10, 2004 9:13 AM To: [EMAIL PROTECTED] Subject: Locking down MQ files/registry on Windows
Folks,
Any Windows gurus out there?
I need to find a way to lock down the registry keys for MQ along with restricting access to the queue and log file systems.
I've got a bunch of "maverick" admins that like to make direct changes to the registry when they need to change things in MQ. I plan to remove access to MQ Services so they can no longer make unauthorized changes there, but even with that available, they still prefer to go right to the registry!!! Unfortunately they need to be in the Administrators group in order to perform other necessary functions. Anybody have a creative idea?
The other issue is protecting the qmgr and log directories from accidental deletion. This one is a toughie...
Thanks in Advance! Gary
Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com Archive: http://vm.akh-wien.ac.at/MQSeries.archive
Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com Archive: http://vm.akh-wien.ac.at/MQSeries.archive
This communication is confidential and may contain privileged material. If you are not the intended recipient you must not use, disclose, copy or retain it. If you have received it in error please immediately notify me by return email and delete the emails. Thank you.
Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com Archive: http://vm.akh-wien.ac.at/MQSeries.archive
_________________________________________________________________ Create a Job Alert on MSN Careers and enter for a chance to win $1000! http://msn.careerbuilder.com/promo/kaday.htm?siteid=CBMSN_1K&sc_extcmp=JS_JASweep_MSNHotm2
Instructions for managing your mailing list subscription are provided in the Listserv General Users Guide available at http://www.lsoft.com Archive: http://vm.akh-wien.ac.at/MQSeries.archive
