New: MQ Enterprise Security Suite

March 10, 2011 Roger Lacroix

Capitalware Inc. would like to announce the official release of MQ Enterprise Security Suite.

MQ Enterprise Security Suite (MQESS) is a new solution that provides authentication and data protection (Channels and Queues) for WebSphere MQ.

MQ Enterprise Security Suite is comprised of:

  • MQ Authenticate Security Exit for Authentication
  • MQ Channel Encryption for Data Protection for Channels
  • MQ Message Encryption for Data Protection for Queues

MQESS operates with WebSphere MQ v6.0 or v7.0 in Windows, Unix, IBM i (OS/400) and Linux platforms.

For more information about MQESS, please go to:
https://www.capitalware.com/mqess_overview.html

Regards,
Roger Lacroix
Capitalware Inc.

Capitalware, IBM i (OS/400), IBM MQ, Linux, MQ Enterprise Security Suite, Security, Unix, Windows Comments Off on New: MQ Enterprise Security Suite

New: MQ Message Encryption v1.0.0

March 8, 2011 Roger Lacroix

Capitalware Inc. would like to announce the official release of MQ Message Encryption v1.0.0.

MQ Message Encryption (MQME) provides encryption for MQ message data while it resides in a queue and in the MQ logs (i.e. all data at rest). In cryptography, encryption is the process of transforming information into an unreadable form (encrypted data). Decryption is the reverse process. It makes the encrypted information readable again. Only those with the key (PassPhrase) can successfully decrypt the encrypted data. MQME uses Advanced Encryption Standard (AES) to encrypt the data. AES is a data encryption scheme, adopted by the US government, that uses three different key sizes (128-bit, 192-bit, and 256-bit).

One of the features that MQME offers is the ability to control who accesses protected queues. This control is obtained through the use of UserID grouping. The group files are implemented in a similar manner to the way they are implemented in Unix and Linux (i.e. /etc/group file). Normally, the ‘mqm’, ‘QMQM’ or ‘MUSR_MQADMIN’ MQ UserIDs or any UserID in the ‘mqm’ group get full access to all messages in all queues. For queues protected by MQME, those privileged UserIds do not get access to the messages in the protected queues unless they are explicitly added to the authorized list of users or groups.

Another feature of MQME is its ability to generate and validate the message via a digital signature. MQME uses the SHA-2 to create a cryptographic hash function (digital signature) for the message data. The digital signature provides verification that the message data has not been altered.

MQME is an MQ API Exit that operates with WebSphere MQ v5.3, v6.0 or v7.0 in Windows, Unix, IBM i (OS/400) and Linux platforms.

For more information about MQME, please go to:
https://www.capitalware.com/mqme_overview.html

Regards,
Roger Lacroix
Capitalware Inc.

Capitalware, IBM i (OS/400), IBM MQ, Linux, MQ Message Encryption, Security, Unix, Windows Comments Off on New: MQ Message Encryption v1.0.0

Why choose MQ Channel Encryption over SSL?

March 8, 2011 Roger Lacroix

MQ Channel Encryption (MQCE) is priced at $299 USD (volume discounts available) per queue manager plus 15% yearly maintenance and support fee. SSL costs roughly $400 per certificate per year from a 3rd party CA (Certificate Authority). Hence, MQCE’s initial cost is cheaper than SSL and the ongoing yearly cost of MQCE is substantially cheaper than the yearly SSL certificate cost (i.e. $45 vs $400).

When a user purchases MQCE licenses, they receive permanent MQCE license keys (i.e. do not expire). SSL certificates expire yearly. If the MQAdmin forgets to update a queue manager’s SSL certificate and it expires, then the channels using SSL stop working.

If the MQAdmin has 50, 100 or more queue managers, how much time is wasted each year by the MQAdmin, just to update each queue manager’s SSL certificate?

    Other Disadvantages of SSL:

  • There is no logging capability to see who accessed which queue manager (MQCE has logging capability).
  • This form of security is only as secure as the integrity of the client side certificates. Anyone who possesses a copy of the certificate will have full access.
  • SSL is dangerous on a Windows PC because a user can copy the ‘keystore’ file to another PC and use the use the ‘keystore’ to successfully connect to the queue manager from the other PC! (i.e. The user can boot the PC from floppy and copy the ‘keystore’ file to diskette.)

For more information about MQCE, please go to:
https://www.capitalware.com/mqce_overview.html

Food for thought.

Regards,
Roger Lacroix
Capitalware Inc.

Capitalware, IBM i (OS/400), IBM MQ, Linux, MQ Message Encryption, Security, Unix, Windows, z/OS Comments Off on Why choose MQ Channel Encryption over SSL?

Security White Paper

March 3, 2011 Roger Lacroix

James Michael Stewart of Global Knowledge has written a white paper called: Ten Ways Hackers Breach Security

Here’s the interesting part:

All too often when hacking is discussed, it is assumed that the hacker is some unknown outsider. However, studies have shown that a majority of security violations actually are caused by internal employees.  So, one of the most effective ways for a hacker to breach security is to be an employee. This can be read in two different ways. First, the hacker can get a job at the target company and then exploit that access once they gain the trust of the organization. Second, an existing employee can become disgruntled and choose to cause harm to the company as a form of revenge or retribution.

When are companies going to secure their MQ environments, so that internal employees cannot get access to sensitive/confidential data?

Note: Please do not say we use a firewall, we use RACF (for z/OS) or the channel’s MCAUSER field has a value because that is NOT securing your MQ environment.

Regards,
Roger Lacroix
Capitalware Inc.

IBM i (OS/400), IBM MQ, Linux, macOS (Mac OS X), MQ Authenticate User Security Exit, MQ Channel Encryption, MQ Enterprise Security Suite, MQ Message Encryption, MQ Standard Security Exit, Unix, Windows, z/OS Comments Off on Security White Paper

New WebSphere MQ v6 End of Service Date

March 3, 2011 Roger Lacroix

The original WebSphere MQ v6 End of Service date was September 30th, 2011, as noted in my blog posting here:
https://www.capitalware.com/rl_blog/?p=98

Just recently, IBM has changed/updated the WebSphere MQ v6 End of Service date to be September 30th, 2012 (they added one more year).
http://www.ibm.com/software/websphere/support/lifecycle/

http://www.ibm.com/common/ssi/ShowDoc.jsp?docURL=/common/ssi/rep_ca/2/897/ENUS211-072/index.html&breadCrum=DET001PT288&url=buttonpressed=DET001PT008&page=0&user+type=EXT&submit.x=12&submit.y=6&lang=en_US

Regards,
Roger Lacroix
Capitalware Inc.

IBM i (OS/400), IBM MQ, Linux, Unix, Windows, z/OS Comments Off on New WebSphere MQ v6 End of Service Date

Flocking

March 3, 2011 Roger Lacroix

And now for something completely different: flocking (aka group behavior). If you ever had a need for an algorithm that handles flocking then have a look at this article (its really interesting):
http://harry.me/2011/02/17/neat-algorithms—flocking

Regards,
Roger Lacroix
Capitalware Inc.

C, Java, Open Source, Programming Comments Off on Flocking

New: MQ Channel Encryption v2.0.0

February 28, 2011 Roger Lacroix

Capitalware Inc. would like to announce the official release of MQ Channel Encryption (MQCE) v2.0.0.

MQCE provides encryption for WebSphere MQ (WMQ) message data over WMQ channels. MQCE operates with Sender, Receiver, Server, Requestor, Cluster-Sender, Cluster-Receiver, Server Connection and Client Connection channels of the WMQ queue managers. MQCE uses Advanced Encryption Standard (AES) to encrypt the data and SHA-2 to create a digital signature.

MQCE operates with WMQ v5.3, v6.0 and v7.0 on Windows, iSeries (OS/400), Unix and Linux environments.

For more information about MQCE go to:
https://www.capitalware.com/mqce_overview.html

Regards,
Roger Lacroix
Capitalware Inc.

Capitalware, IBM i (OS/400), IBM MQ, Linux, MQ Channel Encryption, Security, Unix, Windows Comments Off on New: MQ Channel Encryption v2.0.0

New: MQ Channel Encryption for z/OS v2.0.0

February 28, 2011 Roger Lacroix

Capitalware Inc. would like to announce the official release of MQ Channel Encryption for z/OS (z/MQCE) v2.0.0.

z/MQCE provides encryption for WebSphere MQ (WMQ) message data over WMQ channels. z/MQCE operates with Sender, Receiver, Server, Requestor, Cluster-Sender, Cluster-Receiver, Server Connection and Client Connection channels of the WMQ queue managers. z/MQCE uses Advanced Encryption Standard (AES) to encrypt the data and SHA-2 to create a digital signature.

z/MQCE operates with WebSphere MQ for z/OS v5.3.1, v6.0 and v7.0 on z/OS v1.4 or higher environments.

For more information about z/MQCE go to:
https://www.capitalware.com/mqce_zos_overview.html

Regards,
Roger Lacroix
Capitalware Inc.

Capitalware, IBM MQ, MQ Channel Encryption, Security, z/OS Comments Off on New: MQ Channel Encryption for z/OS v2.0.0

Capitalware releases MQRC2 v1.0.0

February 22, 2011 Roger Lacroix

Do you use IBM’s MQRC program? Do you wish it could display more information? I created an application called MQRC2 to fill this need.

MQRC2 application can interpret an MQ reason code number (i.e. 2035), MQ reason code symbol (i.e. MQRC_OBJECT_IN_USE) or AMQ message number (i.e. AMQ4005) and display the relevant information from the WebSphere MQ Messages manual.

Note: The information outputted belongs to IBM. Capitalware takes no responsibility for the content.

C:\Capitalware\MQRC2>mqrc2 2035

2035 (X'07F3') MQRC_NOT_AUTHORIZED

Explanation:
The user is not authorized to perform the operation attempted:
- On an MQCONN or MQCONNX call, the user is not authorized to connect to the queue manager.
* On z/OS, for CICS applications, MQRC_CONNECTION_NOT_AUTHORIZED is issued instead.
- On an MQOPEN or MQPUT1 call, the user is not authorized to open the object for the option(s) specified.
* On z/OS, if the object being opened is a model queue, this reason also arises if the user is not authorized to create a dynamic queue with the required name.
- On an MQCLOSE call, the user is not authorized to delete the object, which is a permanent dynamic queue, and the Hobj parameter specified on the MQCLOSE call is not the handle returned by the MQOPEN call that created the queue.
- On a command, the user is not authorized to issue the command, or to access the object it specifies. This reason code can also occur in the Feedback field in the message descriptor of a report message; in this case it indicates that the error was encountered by a message channel agent when it attempted to put the message on a remote queue.

Completion Code:
MQCC_FAILED

Programmer Response:
Ensure that the correct queue manager or object was specified, and that appropriate authority exists.

MQRC2 is licensed under Apache License 2.

Regards,
Roger Lacroix
Capitalware Inc.

C, Capitalware, IBM MQ, Open Source Comments Off on Capitalware releases MQRC2 v1.0.0

MiGLayout v3.7.4 Released

February 19, 2011 Roger Lacroix

MiG InfoCom has just released MiGLayout v3.7.4.
http://www.miglayout.com

For Java developers writing GUI layouts by hand that wants simplicity, power and automatic per platform fidelity, that are dissatisfied with the current layout managers in Swing, JavaFX and SWT, MigLayout solves your layout problems. User interfaces created with MigLayout is easy to maintain, you will understand how the layout will look like just by looking at the source code.

Regards,
Roger Lacroix
Capitalware Inc.

Java, Open Source Comments Off on MiGLayout v3.7.4 Released