WebSphere Message Broker Fix Pack 6.0.0.5 released

WebSphere Message Broker Fix Pack 6.0.0.5 has been released.

The issues reported on the withdrawn Fix Pack 6.0.0.4 has been addressed.

Filed under: ibm, websphere, wmb

New version of RFHUTIL (IH03) supports SSL connections

Today a new release of the IH03: WebSphere Message Broker V6-Message display, test & performance utilities support pack was released (more commonly known as RFHUTIL).

The most interesting and important feature for me in my day to day work was the introcuced SSL capabilities. RFHUTIL now works as you would expect from a native WebSPhere MQ client application, reading the MQSSLKEYR environment variable to locate the keystore.

I used a script like this to connect to a remote queue manager using a server connection channel with a NULL_SHA SSL configuration:

@echo off

set RFHUTIL_HOME=”%cd%”

set SVRCONN=CLIENTS.ADMIN
set HOST=10.10.10.10
set PORT=1414

set MQSSLKEYR=C:\ih03\ssl\key

set MQSERVER=%SVRCONN%/TCP/%HOST%(%PORT%)

%RFHUTIL_HOME%\rfhutilc.exe

The keystore is named key.kdb and is stored together with stash and the other related files in the c:\ih03\ssl\ folder.

I used these settings in the “Set Connection User Id” dialog (click the Set Conn Id button to open):

Be sure to select the correct settings from the Queue Manager Name drop-down list.

This will enable the usage of IH03 in in environments with SSL security requirements, a really good thing!

Filed under: ibm, ih03, mq, rfhutil, support pack, tool, websphere, wmq

WMQ Explorer and SSL

A couple of fixpacks ago I tested to connect to a remote queue manager sing a SSL configured server connection channel. Then things didn’t work out that well, but now a couple of refresh/fixpacks later everything wors much better.

To start with I must say that I don’t really fancy the way SSL is enabled from the WMQ Explorer point of view. The keystore parts of the configuration is ok but to connect to a queue manager using SSL you need to provide the WMQ Explorer with client channel definition table (CCDT).

For those of you not familiar with CCDT: it’s basically a binary format where an MQ server can store it’s client connections. Client connections in turn is data needed to connect to a queue manager in a client mode (includes parameters as connection, ssl etc). The CCDT file can be distributed to clients who can use it as the basis for their connection. As the CCDT file is binary there is no easy way to create it by hand. Running runmqsc on a WebSphere MQ server box will make it possible to create the CCDT but that is a bit heavy-weight in my opinion. The best aproach I’ve found so far is to use the MO72: MQSC Client for WebSphere MQ support pack by Paul Clarke.

MO72 has the follwing features (among others):

• Running mqsc on remote queue managers (inclusing WebSphere MQ security using SSL)
• Creating/altering/deleting client connections
• Can use the configuration file of the MO71 support pack

To create a CCDT from scratch using MO72 run the following command:

mqsc -n -t c:\AMQCLCHL.TAB

to add a client connection channel issue a define script:

DEFINE CHANNEL('CLIENTS.ADMIN') CHLTYPE(CLNTCONN) CONNAME('11.111.1.111(1414)') MAXMSGL(104857600) QMNAME('QM1') SSLCIPH('NULL_SHA') TRPTYPE(TCP) REPLACE

This CCDT assumes that there are a server connection channel named CLIENTS.ADMIN defined in the queue manager listening on port 1414 and host 11.111.1.111 with the rest of the properties in the client connection channel also defined in the server connection channel.

To gain access to the remote queue manager using SSL:

• The key and truststores need to be configured (Window -> Preferences -> WebSphere MQ Explorer -> SSL Client Certificate Stores)
• Add the queue manager
  • Right-click on Queue Managers -> Select “Show Hide Queue Managers” -> Click Add
  • Choose “Connect” and fill in the name of the queue manager, click Next
  • Choose “Use client channel definition table, and browse for the CCDT file, click Finish

Mission accomplished, SSL now works as a charm.

But why was this implemented using CCDT’s? I can’t see any reason really. I would like to see something like a custom SSLSocketFactory implemented in WebSphere MQ Explorer making it possible to use multiple key and trust stores and easier configuration on top of that. An example of an custom SSLSocketFactory was published by Peter Broadhurst on the a Hursley view on WebSphere MQ blog a couple of months ago.

Perhaps I’ll send in a proposal/requirement to get this configuration more simple and understandable.

Filed under: MO72, ibm, mq, support pack, websphere, wmq

Great post on MQMON (support pack)

In a previous post of mine is promised to get back to the details of the new version of the MQMON support pack. That hasn’t happened, as you might have noticed, but luckily someone else has

The a Hursley view on WebSphere MQ blog, has an interesting  post on the HTTP capabilities of the MQMON support pack.

Filed under: mo71, mq, mqmon, support pack, websphere, wmq

IS02 revisited – version 3 released

For those of you who don’t know that much about IS02 here’s the short-short summary:

• Can administer (deploy to multiple eg’s at once, start/stop flows, create/delete execurtiongroups) local and remote brokers
• Support SSL connection to the configuration manager queue manager
• Can subscribe to and present statistics and accounting data. The drawback here is that access to an unsecured SYSTEM.DEF.SVRCONN is required (an mqm nightmare)
• Integrated with the WMQ Explorer (showing broker, configuration manager and mq objects side by side)

Back in may I wrote a post on the IS02 support pack. The background story was a customer of mine who currently set up multiple message brokers (WebSphere Message Broker) in an active-active cluster utilizing WebSphere MQ workload balancing features.

From a management/tool view-point the message broker has been all but complete. I was very excited to try out the IS02 support pack as it’s a lean alternative to the all-but-lean Message Broker Toolkit.

The previous post covered the functionality of version two, the version three of IS02: WebSphere Message Broker Explorer Plug-in was released a couple of days ago and today I gave it a shot.

The conclusion is (based on a setup where the configuration manager is installed on a separate box from the eclipse platform):

• Your configuration data (configuration manager connection) is now persisted and wil appear after restart of the eclipse platform.
• Message sets still can’t be removed
• You still need do create sender and receiver channels despite the fact that you’re using WebSphere MQ clusters where the broker(s) and configuration manager’s queue managers are within the same cluster.

So, a bit better but more need to come before this becomes really useful.

Filed under: ibm, is02, websphere, wmb

MQMON 6.0.4 (MO71 support pack) released

I just read about new release of MQMON or MO71: WebSphere MQ for Windows – GUI Administrator that IBM wish calling it.

The support pack can be downloaded from here.

I havn’t had the time to play around with it yet but i definitely will very soon. By looking at the new features one can find:

• HTTP support
• Toolbar support

I’ll get back with another post on the subject as soon as I’ve had a chance to test it.

Filed under: ibm, mo71, mqmon, support pack, websphere