Apache HTTP Server 2.4 Released

February 27, 2012 Roger Lacroix

The Apache Software Foundation has just released Apache HTTP Server v2.4.
https://blogs.apache.org/foundation/entry/the_apache_software_foundation_celebrates

The Apache HTTP Server Project is an effort to develop and maintain an open-source HTTP server for modern operating systems including UNIX and Windows NT. The goal of this project is to provide a secure, efficient and extensible server that provides HTTP services in sync with the current HTTP standards.

Regards,
Roger Lacroix
Capitalware Inc.

Linux, macOS (Mac OS X), Open Source, Unix, Windows Comments Off on Apache HTTP Server 2.4 Released

WMQ v7 Java applications and JMS messages (MQRFH2)

February 23, 2012 Roger Lacroix

I have been banging my head against the wall this week over weird things in WMQ v7, so I figured I would post this so that people in the future would have less of a headache.

A year or so ago, I noticed some odd behavior in WMQ v7 with Java applications reading messages with a message format of MQRFH2 but I ignored it because I was simply far to busy to investigate it.

This week I decided to do so testing of Java applications using WMQ v7.0 and Java JMS applications using WMQ v7.1. Nothing too strange about that. If the Java application put JMS (MQRFH2) messages on the queue then the Java JMS application was able to consume them (normal stuff). When the Java JMS application put JMS (MQRFH2) messages on the queue, the Java application would throw an exception because it was receiving a message with MQMD.Format set to MQSTR. When I looked at the message via MQ Explorer or MQ Visual Edit, there it was in the queue as a plain message and no MQRFH2 but rather MQSTR for the message format.

At first, I thought I messed up my bindings file. I checked and checked, and the JMS queue property ‘TARGCLIENT’ was set to ‘JMS’.

When I would run a JMS application, it could consume the message without any issue. Hence, the head banging had begun. 🙁 Plus if I ran the exact same Java application but with the WMQ v6 MQ JAR files, everything was fine.

I did testing of messages with a format of MQRFH v1, MQCIH, MQDEAD, MQIIH, MQXMIT, MQHSAP and SMQBAD and all of these messages worked as expected in WMQ v6, WMQ v7.0 and WMQ v7.1. It was as if I had a virus on my server but only for WMQ v7.0 and WMQ v7.1 queue managers.

The other weird item that I noticed, is that the length of the message, as shown by MQ Explorer or MQ Visual Edit was wrong for the data it was presenting. The length value included the missing/non-existent MQRFH2 header plus the message data.

I tried hundreds of combinations, searched the internet (read the manuals) and came up with nothing. Today, just by dumb luck, I stumped across a small paragraph in the WMQ Using Java manual and it said:

Existing applications which rely on the presence of MQRFH2s containing properties must be changed to use the get*Property methods or to specify MQC.MQGMO_PROPERTIES_FORCE_MQRFH2 to continue receiving properties in the MQRFH2 format. If the application cannot be changed then the queue attribute PropertyControl can be changed to the value MQPROP_FORCE_MQRFH2 so that properties are always returned in MQRFH2 form.

Are you kidding me!!! Who at IBM thought it was a good idea to change the default behavior of the processing of 1 message type? But not change the behavior for the others: MQRFH v1, MQCIH, MQDEAD, MQIIH, MQXMIT, MQHSAP and SMQBAD. There are millions of Java (non-J2EE) applications running in the real world that expect and deal with MQ messages with a format of MQRFH2.

Who ever came up with this bright idea (sarcasm) should be demoted or fired. This is so customer unfriendly that it boggles the mind. WMQ v6 goes out of support in 7 months (September 2012). There will be thousands/millions of queue managers upgraded in the coming months and there will be millions of deployed Java (non-J2EE) applications that will instantly break for no fault of any developer or support person. And in this case, developers will be correct in saying that it is MQ’s fault that their application no longer works!

I am just floored at the stupidity in this decision. IBM could have added the feature but made it optional. i.e. Java applications receive the messages with the format MQRFH2 as it was in WMQ v5.3 and WMQ v6.0.

Secondly, why implement the feature for only 1 message type? What about messages with the format of MQRFH v1, MQCIH, MQDEAD, MQIIH, MQXMIT, MQHSAP and SMQBAD? Why wasn’t this abstraction available for those message types?

Third, why did IBM only implement the abstract layer for Java (non-J2EE)? What is wrong with native applications? There are millions of native (C/COBOL) applications that deal with MQRFH2 messages but IBM decided that they do not qualify for this nice new feature? What, is IBM giving the middle-finger to native applications? (A lot of that going on lately).

Fourth, who implements an abstraction layer but sets the message length to the wrong value. If the abstraction layer is pulling the message data out of the MQRFH2 message and changing the MQMD.Format field to MQSTR then it bloody well better set the message data length to the correct length.

Everybody keeps talking about the 2012 Apocalypse, well, way to go IBM. You have just created your own 2012 Apocalypse with this goofy and strangely implemented Java (only) abstraction layer.

Do you have ANY idea of how many Java applications that have been running untouched for 5+ years? With all the merges and layoffs of the last 10 years, do you have ANY idea of how many production Java applications where the source code is lost?

I hope IBM support staff is ready for the number of PMRs that people will open over this issue. How many thousands of hours will be lost by customer’s support staff and MQAdmins trying to figure out why things are crashing?

After the customer has wasted numerous hours of support staff time and opened a PMR with IBM, IBM will say, change your application code or change the queue’s PropertyControl attribute to “Force MQRFH2”.

As I said, are you kidding me. 🙁

To all of those MQ customers that are or who will be feeling this pain, you have my sympathy and hopefully this blog posting helps you out.

Regards,
Roger Lacroix
Capitalware Inc.

IBM i (OS/400), IBM MQ, Java, JMS, Linux, Programming, Unix, Windows, z/OS 4 Comments

Where’s the MQ Security?

February 15, 2012 Roger Lacroix

I was at Wendy’s (in Canada) for lunch today and the cashier put the following flyer on my tray:


Of course, it made me smile because I recently wrote a blog item that MQ people still need to implement either SSL or a security exit in WMQ v7.1.

Maybe, I should create some T-Shirts with “Where’s the MQ Security?”.

If you are looking for a security product for WMQ then please have a look at MQ Authenticate User Security Exit (MQAUSX). MQAUSX offers application (or user) authentication of UserID and Password against a native OS system, LDAP server, Microsoft’s Active Directory, Quest Authentication Services (QAS), Centrify’s DirectControl or an encrypted MQAUSX FBA file. If interested, check out MQAUSX at https://www.capitalware.com/mqausx_overview.html

Regards,
Roger Lacroix
Capitalware Inc.

Capitalware, IBM i (OS/400), IBM MQ, Linux, MQ Authenticate User Security Exit, MQ Channel Encryption, MQ Enterprise Security Suite, MQ Message Encryption, MQ Standard Security Exit, Unix, Windows, z/OS Comments Off on Where’s the MQ Security?

LibreOffice 3.5 Released

February 14, 2012 Roger Lacroix

LibreOffice has just released LibreOffice v3.5.
http://www.libreoffice.org

LibreOffice is a comprehensive, professional-quality productivity suite that you can download and install for free. There is a large base of satisfied LibreOffice users worldwide, and it’s available in more than 30 languages and for all major operating systems, including Microsoft Windows, Mac OS X and Linux (Debian, Ubuntu, Fedora, Mandriva, Suse, …).

Regards,
Roger Lacroix
Capitalware Inc.

Linux, macOS (Mac OS X), Open Source, Windows Comments Off on LibreOffice 3.5 Released

Very Cool: PortableApps.com

February 10, 2012 Roger Lacroix

I just came across PortableApps.com and was amazed by what I found. I have no idea how I have never heard of them before now!! (It has been around since 2004.)
http://portableapps.com

PortableApps.com is the world’s most popular portable software solution allowing you to take your favorite software with you. A fully open source and free platform, it works on any portable storage device (USB flash drive, iPod, memory card, portable hard drive, etc). With millions of users all over the world and a full collection of open source software as well as compatible freeware and commercial software and partners in the software and hardware industry, PortableApps.com is the most complete solution for life on the go.

Regards,
Roger Lacroix
Capitalware Inc.

Open Source, Windows Comments Off on Very Cool: PortableApps.com

IBM announces End of Support for WebSphere MQ v6.0

February 10, 2012 Roger Lacroix

IBM has announced that support for WebSphere MQ v6.0 will end on September 30th, 2012.
http://www.ibm.com/support/docview.wss?uid=swg21584325&myns=swgws&mynp=OCSSFKSJ&mync=R

If you are running WebSphere MQ v6.0 on any of the following platforms then you will need to migrate to WebSphere MQ v7.0 to have support for WebSphere MQ.

  • AIX
  • HP-UX (Itanium)
  • HP-UX (PA-RISC)
  • iSeries (IBM i or OS/400)
  • Linux (POWER)
  • Linux (x86)
  • Linux (x86-64)
  • Linux (zSeries)
  • Linux (zSeries s390x)
  • Solaris (SPARC)
  • Solaris (x86-64)
  • Windows
  • z/OS

Regards,
Roger Lacroix
Capitalware Inc.

IBM i (OS/400), IBM MQ, Linux, Unix, Windows, z/OS Comments Off on IBM announces End of Support for WebSphere MQ v6.0

Free IBM e-book: Thinking outside the data warehouse

February 8, 2012 Roger Lacroix

IBM is giving away free copies of the e-book: Thinking outside the data warehouse
https://www14.software.ibm.com/webapp/iwm/web/signup.do?source=sw-infomgt&S_PKG=500018646

Thinking outside the data warehouse: How businesses increase agility, boost performance and lower TCO

Regards,
Roger Lacroix
Capitalware Inc.

E-Book, Education Comments Off on Free IBM e-book: Thinking outside the data warehouse

MQAUSX LDAP on Linux x86 & Linux x64

February 1, 2012 Roger Lacroix

When MQAUSX first supported LDAP authentication, Capitalware used Novell’s LDAP Libraries for C for AIX, HP-UX, Solaris, Linux x86, Linux x64 (x86 64-bit) and Windows. Several years ago, for AIX, HP-UX and Solaris platforms, we switched to the native/included client LDAP libraries that are available for each OS (Operating System).

This week, a weird bug was discovered in the native/included OpenLDAP Client on Linux for zSeries. OpenLDAP has deprecated ldap_init() function in favor of ldap_initialize() function. Even though ldap_init() function is still supported by OpenLDAP, the client LDAP library crashes when it is used on Linux for zSeries. Therefore, I am going to switch the ldap call from ldap_init() to ldap_initialize() on all platforms that use OpenLDAP.

MQAUSX LDAP is supported on 4 Linux distributions: x86, x64, Power and zSeries. But of course there are always wrinkles: MQAUSX LDAP uses 2 different LDAP clients on the various Linux distributions.

  • Linux x86 and Linux x64 use Novell’s LDAP Libraries for C
  • Linux on Power and Linux on zSeries use the native/included OpenLDAP

So, to be consistent on all Linux distributions, MQAUSX LDAP will only use OpenLDAP in all future releases.

So, what does this mean for customers?

  1. Starting with v1.5.2.7, MQAUSX will no longer include Novell’s LDAP Libraries for Linux x86 or Linux x64
  2. If you wish to use MQAUSX LDAP (v1.5.2.7 or higher) on Linux x86 or Linux x64 then the “openldap-clients” package must be installed on your Linux server. There is a high probability that this package is already installed on your Linux server. A quick way to check is to issue the following Linux command:
rpm -q -a | grep -i ldap

Please let me know if you have any questions or comments.

Regards,
Roger Lacroix
Capitalware Inc.

Capitalware, IBM MQ, Linux, MQ Authenticate User Security Exit, Security Comments Off on MQAUSX LDAP on Linux x86 & Linux x64

Mozilla Firefox 10.0 Released

January 31, 2012 Roger Lacroix

Mozilla Firefox has just released Mozilla Firefox v10.0.
http://www.mozilla.com/firefox/

Mozilla Firefox is a free and open source web browser descended from the Mozilla Application Suite and managed by Mozilla Corporation. To display web pages, Firefox uses the Gecko layout engine, which implements most current web standards in addition to several features that are intended to anticipate likely additions to the standards

Regards,
Roger Lacroix
Capitalware Inc.

Linux, macOS (Mac OS X), Open Source, Windows Comments Off on Mozilla Firefox 10.0 Released

MQAUSX/MQSSX versus WMQ v7.1 CHLAUTH

January 30, 2012 Roger Lacroix

Last week, there was a robust/lively discussion on the MQSeries List Server regarding Derek Hornby’s question of (see http://comments.gmane.org/gmane.network.mq.devel/13985):

In the MQ V7.1 base install, a channel authentication record is created which is a “block user list” for all channels, and the block is on a User List of *MQADMIN

So I created a User Map record which allows the following:

– Channel Profile: MON.CHANNEL Address: 10.123.99.99 Client User: “monitor” MCAUser: “mqm”
– so I could allow my monitor program running on a client box to have “mqm” privileges against the Queue Manager
– but it gives me a 2035 (“MQ channel blah was blocked from address blah”) unless I remove the default block user list….

I thought the specific “allow” record which switches client ID “monitor” to MCAUser “mqm” would override the “block” record, but, unfortunately, it does not. (but it really should!)

And T.Rob Watt said:

Instead, keep the default rule and add another *blocking* rule to allow administrators on your specific channel:

set chlauth(MON.CHANNEL) TYPE(BLOCKUSER) USERLIST('nobody')

The final solution as given by T.Rob Watt was to add the following channel authentication records:

SET CHLAUTH('MON.CHANNEL') TYPE(ADDRESSMAP) ADDRESS('*') USERSRC(NOACCESS) WARN(NO) ACTION(ADD)
SET CHLAUTH('MON.CHANNEL') TYPE(ADDRESSMAP) ADDRESS('10.123.99.99') USERSRC(CHANNEL) ACTION(ADD)

And T.Rob Watt commented:

So, yes, if somebody deletes the default *MQADMIN rule or defines a rule that overrides it to allow admin access AND DOES NOTHING ELSE then I suppose you are correct “the nobody rule opens a big security hole.” But I think it’s pretty clear that the intent was NEVER to define that rule without some kind of strong authentication. If any doubt remains, I’ll temporarily switch to HTML so I can write it in 80-point red letters:

ADMIN ACCESS MUST BE STRONGLY AUTHENTICATED

Here are my thoughts: if you need to implement authentication (or some filtering mechanism via an exit) with WMQ v7.1 channel authentication records then why not just use one solution?

How can you accomplish this (answering Derek’s question) with either MQAUSX or MQSSX? Simple, just use the following IniFile keywords with MQAUSX or MQSSX:

UseAllowIP = Y
AllowIP = 10.123.99.99;10.123.99.111
UseAllowUserID = Y
AllowUserID = monitor
Allowmqm = N
UseProxy = Y
ProxyFile=C:\Capialware\MQAUSX\proxy.txt

And in the proxy.txt file you would have:

monitor = mqm

Lines 1 & 2 of the IniFile define what incoming IP addresses will be allowed (the user can also use wildcards). Lines 3, 4 & 5 of the IniFile define what UserID is to be allowed. Lines 6 & 7 of the IniFile define that a Proxy file is to be used and the name and location of the Proxy file.

Hence, these simple, clear and easy keywords totally lock down the channel without requiring any MQ rules or other 3rd party products.

What is the difference between MQAUSX and MQSSX? MQAUSX provides full UserID and Password authentication whereas MQSSX is a filtering mechanism (no authentication).

Regards,
Roger Lacroix
Capitalware Inc.

Capitalware, IBM i (OS/400), IBM MQ, Linux, MQ Authenticate User Security Exit, MQ Standard Security Exit, Security, Unix, Windows, z/OS Comments Off on MQAUSX/MQSSX versus WMQ v7.1 CHLAUTH