Websphere MQ Theme and SSL

I’m trying to understand how common the use of MQ themes is in the industry. And MQ with SSL?

Thanks Guy

+4
source share
1 answer

Pub / Sub
Prior to V7, WMQ Pub / Sub was available either as a standalone WMQ component or as part of the WebSphere Message Broker functionality. Now in v7 pub / sub is an integral part of WMQ and provides theme-level security. There is a certain amount of pub / sub adoption that happens only because it is now baked into WMQ as built-in functionality.

Another factor affecting absorption in pub / sub WMQ is that more people become available with WMQ File Transfer Edition. WMQ FTE makes file transfer status available as publications, and many people with this product write applications that control these topics to provide many custom features. After they start using pub / sub, many of these stores begin to see other use cases.

Pub / Sub also solves some common message problems, such as the application that is currently writing to the queue, and there is a new requirement to get a copy of this message to another consumer. Prior to version 7, switching the application to write to the queue to write to the topic was somewhat invasive and required configuration changes for JMS applications or code changes for other types of code. The easiest way to solve this problem is to intercept a message with an application or exit that copies the copies in two or more queues. Starting with v7, an application written for queues can be provided with a topic alias. The manufacturer still thinks he is writing to the queue, but WMQ is posting messages for the topic. Consumers can either subscribe directly, or, in the case of outdated code that requires a queue, an administrative subscription can cause messages on this topic to be delivered to the queue. I see a lot of attention on pub / sub to satisfy these requirements.

There are also cases where pub / sub is a suitable solution and is used only for this reason. In the past, the requirement for individual components, an administrative skill, or a WMB license was an obstacle to adoption, which caused a certain part of pub / sub applications to be processed as point-to-point. When pub / sub is built into WMQ, these barriers are removed or at least significantly reduced, which leads to more absorption simply because it is the right architecture for this problem.

In general, I would say that WMQ pub / sub switched to mainstream with v7. Since v6 life has been announced since September 2011, there will be massive migration to v7 this year, followed by an even wider use of pub / sub.

SSL / TLS
As for SSL, WMQ security is approaching the mainstream. I would not say that SSL is the norm - for now - but over the past two to three years, it is enough that my QQ Security Lab QQ at IMPACT and European WebSphere conferences will be overflowed. I wrote recently ...

The term "trusted internal network" was coined to distinguish this part of the network, which was an internal destination outside the firewall. But the term "trusted" used in this context is relative. It was not assumed that the internal network was trusted implicitly, just that it was more trusted than things outside the firewall. Unfortunately, this term is sometimes interpreted quite literally. I had clients pretty seriously tell me, by definition, we trust everything on a "trusted internal network", so we call it that. Of course, this is an overestimated case, because even the most persistent believers trust the internal network, it still applies the login password to servers, databases and applications. Thus, the internal network is trusted, but only to a certain point, and even in the internal network, authentication and authorization is necessary.

Although SSL (TLS, in fact) is encrypted, they are also authenticated. As more and more people realize that they need to authenticate WMQ connections on a β€œreliable” internal network, SSL was a common way to achieve this. Of course, the need for privacy services (encryption) and integrity of WMQ channels for internal and external connections is growing, and this also leads to the introduction of WMQ SSL channels.

Now that SSL is more common, there are a number of minor issues that arise when people do not fully understand the security of WMQ. The fact that these are now common topics in WMQ listserve and on MQSeries.net is indicative of SSL acceptance. Some of these minor issues include including root certificates for unused certificates in the QMgr store or lack of QMgr channel settings such as SSLPEER (which filters connections using a distinguished name) or MCAUSER (which maps permissions to a specific user account). Often people use SSL, but do not see one or more of these other parameters and do not achieve the level of security that they intended. Since you must enable SSL for these things in order to present a problem, this, like my friend, says "luxury problem." It is much better if you have problems with SSLPEER settings, and not with SSL at all.

In short ...
So I assume that the short answer to both of these questions is that using pub / sub and SSL in WMQ is pretty common. And now, and now, when I am writing new applications, I would definitely use SSL and feel free to use WMQ pub / sub, where it is called.

+6
source

Source: https://habr.com/ru/post/1333054/


All Articles