In IBM WebSphere MQ, can you disable TLSv1.0 and TLSv1.1 SSL ciphers / protocols?

https://developer.ibm.com/answers/questions/213076/in-ibm-websphere-mq-can-you-disable-tlsv10-and-tls.htm

In IBM WebSphere MQ, can you disable TLSv1.0 and TLSv1.1 SSL ciphers / protocols?

Question by MCregge  (3351) | Sep 10, 2015 at 06:54 AMMQSSLTLSCIPHERSTLSV1.1TLSV1.0

In IBM WebSphere MQ, can you disable TLSv1.0 and TLSv1.1 SSL ciphers / protocols?

Like ·    1 ·    Comment   Reward user

3 answers

 · Add your answer

• Sort: 

Accepted answer

Answer by MCregge (3351) | Sep 10, 2015 at 06:55 AM

As you probably know, the latest updates to MQ are deprecating (disabling) the use of SSLv3 ciphers (and some "weak" TLS ciphers) due to known security vulnerabilities. Several customers have asked about disabling TLSv1.0 and TLSv1.1 ciphers also.

---

*There is a new APAR which allows disabling TLSv1.0 ciphers at the listener level in the latest maintenance releases of MQ v8 and v9. This is enabled via a qm.ini setting, see:

 SSL:
    AllowTLSV1=NO  

http://www.ibm.com/support/docview.wss?uid=swg1IT23235

---

Before that APAR, TLSv1 could not be disabled at the listener level, but you could still configure MQ to only allow channel communications on certain ciphers.

The simplest way to disable TLSv1.0 & TLSv1.1 protocols would be to set a TLSv1.2 cipherspec in the channel definition. The queue manager will only allow that cipherspec to be used which was configured on the channel; thus if you configure your channels with TLSv1.2 ciphers, that would mean that TLSv1.0 & TLSv1.1 protocols being disabled.

There is another way to disable TLSv1.0 protocol which is by enabling Suite B mode. The GSKit docs state that Suite B will disable all protocols except TLSv1.2. Information on Suite B implementation is here:

https://www.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.sec.doc/q010200_.htm?lang=en

The configuration of Suite B mode is given in the following link:

https://www.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.sec.doc/q010210_.htm

To have a look at the list of cipherspecs and the corresponding protocols used by them, follow the below link:

http://www.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.sec.doc/q014260_copy.htm

Update: MQ/SSL connections can not disabled at MQ listener level, the options noted above cause the MQ channel to fail to start unless using an adequate cipher, but they do not disable the MQ listener process from initially receiving the TLSv1.0 session.

I hope this helps. Please add comments or info.

---

Related info:

Deprecation: SSLv3 protocol ( MQ v7.0.1.13, v7.1.0.7, v7.5.0.5, v8.0.0.2 )
http://www-01.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.pro.doc/q123420_.htm?lang=en

Deprecation: Weak Ciphers deprecated ( MQ v7.0.1.13, v7.1.0.7, v7.5.0.6, v8.0,0.3 )
http://www.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.pro.doc/q123425_.htm?lang=en

Like ·    0   Comment   Reward user   Share

Answer by CarlosBarros (1) | Oct 15, 2015 at 11:06 AM

We have some problems regarding the suggestions.

Set a TLSv1.2 cipherspec in the channel definition doesn't mean the TLS 1.0 and TLS 1.1 will be disable. We did the test and they are enable.

Set SUITEB on queue manager will force the ciphers TLS 1.2 with elliptic curve. Unfortunately, ciphers with elliptic curve are vulnerable too. http://www-01.ibm.com/support/docview.wss?uid=swg21688949

Do we have any other option to disable the TLS 1.0 and TLS 1.1?

Like ·    0   Comment   Reward user   Share

Answer by MCregge (3351) | Aug 01, 2016 at 10:55 AM

Before APAR IT23235 (noted above), by default MQ would accept the TLS 1.0 connection and then disconnect it if it requests a channel that requires TLS 1.2.
There was no way to disable TLS 1.0/1.1 completely short off the SUITEB setting noted above..

If there is a need to fully disable TLS 1.0/1.1 the recommendation is to create an Enhancement requests at the following website:

http://www.ibm.com/developerworks/rfe/?BRAND_ID=181

Select 'IBM MQ', then can search or submit new requests.

Like ·    0   Comment   Reward user   Share

How to list defects with special key work from the fix list using Linux command

lynx -nonumbers -dump http://www-01.ibm.com/support/docview.wss?uid=swg27043086|grep -E 'memory leak|Fix Pack'|grep -B1 'memory leak'|perl -ne 's/^\s+//;print'|grep -v "\-"

lynx:

-nonumbers : 去掉行數
-width         : output 的欄位長度, 預設為80, 因此可看見最後一個fix 顯示有問題, 加長後解決
-dump         : 直接純文字輸出到螢幕

perl:

-n                :按行讀取
-e                :執行右邊的命令

未加 -width

















加-width=120
lynx -nonumbers -width=120 -dump http://www-01.ibm.com/support/docview.wss?uid=swg27043086|grep -E 'memory leak|Fix Pack'|grep -B1 'memory leak'|perl -ne 's/^\s+//;print'|grep -v "\-"|grep -E ' memory leak|Fix Pack'

參考資料﹕
Perl命令行使用技巧
https://wenku.baidu.com/view/96060bee4afe04a1b071de48.html

regular expression to hide the lines having string in glogg (like grep -v)

Glogg is a good tool to view a large log file.
I try to exclude some lines just like the command "grep -v" and found the solution from the forum.


This solution is from the goggle glogg forum.

https://groups.google.com/forum/#!searchin/glogg-devel/exclude$20lines%7Csort:date/glogg-devel/K3tontwTBME/csIPkHIDc0UJ


Original question:

Hi Guys 

I use your application alot to scroll through massive logs we have on 
our web application. I wish you could add a feature where you can 
quickly hide lines not matching the Filters so you can quickly see 
what you need to see without having to scroll huge number of lines. 

Another essential feature missing is that glogg is not showing Lines 
numbers. Please consider adding these features. Thanks


Solution:

=========================
^((?!STRING1|STRING2).)*$
=====================
Overly simplified explanation:

^ beginning of line
! negates the search
? look ahead for STRING1 or STRING2
. matches everything
* matches zero or more of them on the same line
$ end of line
( and ) groups items

So this matches every line that does not have STRING1 and every line that does not have STRING2.  You can add as many strings, using regular expressions, or course, as you like.  I use this to find things I don't expect to find in our syslogs.


glogg - the fast, smart log explorer
https://glogg.bonnefon.org/


***在grep 中可以用-P 選項(Perl RE)來測試 (亦可用notepad++或其他有支援RE的編輯器)

(?=)和(?!)並不會收納在match group中, 可見下面詳細說明。


參考資料﹕
正規表示式 Regular Expression
http://ccckmit.wikidot.com/regularexpression


lookahead, lookbehind
RegExp 應用： lookahead , lookbehind
http://darkk6.blogspot.com/2017/03/regexp-lookahead-lookbehind.html

以下說明來自上面網頁連結的詳細說明！
==================================================================
正規表示法一直都是我很推大家學習的東西，在字串處理上真的有很大很大的幫助以及好處，前幾天朋友工作上需要用到正規表示法處理字串，目的是：「在一個字串中找出連續數字 6~8 個」，這邊要注意的是，連續九個的話是不要的。

例如： 12345 XD Hi12345678ab666666cd987654321

要找出： 12345678 和 666666；但不可以找出 987654321 中的 98765432 或者 87654321

於是我第一個想到的東西就是 Lookahead 和 lookbehind。

先來看一下如果直接使用 \d{6,8} 會取出什麼：Visual Regex Tester
可以看到，直接使用 \d{6,8} 是會連後方的 987654321 取出來。

最後我給的的解法是：(?<!\d)\d{6,8}(?!\d)，結果：Visual Regex Tester

重點就在前面的 (?<!\d) 和後面的 (?!\d) 這兩個表示法，他們分別代表的是
negative lookbehind 和 negative lookahead



先來看 lookahead , 意思是「往前看」，語法為：
Positive lookahead ： X(?=Y)
Negative lookahead ： X(?!Y)
解釋為： 我要找 X 而其後方必須/不可為 Y ；而其中 X 和 Y 都可以是一個合法的表達式。

這邊要注意的是，要找的是 X , Y 只是附註條件，並不會被收納在 match group 中

實際例子： \d(?=[AB]) ，我要找一個數字，且後方必須是 A 或 B

因此這個字串：123A4C5B67 中，符合的只有 3 和 5；要注意，不是 3A 和 5B，是 3 和 5
結果：Visual Regex Tester

同樣的字串，若將 Pattern 改為：\d(?![AB])，則代表要找一個數字，且後方不能跟著A或B。如此一來符合的就是：123A4C5B67 中的： 1,2,4,6,7
結果：Visual Regex Tester

簡單來說可以想像類似於正規表示法中的 if 判斷，可以多多善用這個表示法。
-----

接著來看 lookbehind ，這邊要注意的是，並非所有程式語言都支援 lookbehind，我自己目前常用的程式語言中，似乎也只有 java 支援。(javascript 是不支援的喔)

lookbehind 就是向後看，同樣也分為 positive 和 negative：
Positive lookbehind ： (?<=Y)X
Negative lookbehind： (?<!Y)X
※ 注意，條件是放在 X 之前

同樣舉實際例子：(?<=[OP]).，要找任何一個字，且前方必須是O或P。或也可以這樣來稱呼：「尋找接在 O 或 P 後面的一個文字」

字串：AOIOOXPAOCKNJS ，符合的就是 I,O,X,A,C
結果：Visual Regex Tester

Negtive 就不多舉例，能理解就好。
-----


那麼回到最開始的表示法：(?<!\d)\d{6,8}(?!\d)，來解釋看看這一段到底在找什麼東西。

先將其拆為：(?<!\d)　\d{6,8}　(?!\d) 三段，很快就可以看出，要找的東西是「6~8 個連續數字」，但是「前面不能有數字(Negative lookbehind)」以及「後面不能跟著數字(Negative lookahead)」。

由於 {6,8} 是 Greedy ，會盡量多取，因此就可以限制找到的數字數量是在 6~8 ，並且排除連續 9 個(以上)數字的部分了。
=========================================================================================

Fail to connect to qmgr with 2035 error

WMQ 7.1 / 7.5 / 8.0 / 9.0 queue manager RC 2035 MQRC_NOT_AUTHORIZED or AMQ4036 or JMSWMQ2013 when using client connection as an MQ Administrator
http://www-01.ibm.com/support/docview.wss?uid=swg21577137


AMQ5540, AMQ5541 and AMQ5542, application did not supply a user ID and password, 2035 MQRC_NOT_AUTHORIZED
http://www-01.ibm.com/support/docview.wss?uid=swg21680930

troubleshooting DLQ problem

參考第30 -37頁

http://www-01.ibm.com/support/docview.wss?uid=swg27018059

XQH: 585148
STR : 535452
DLH: 444C48

extract line number between n1 and n2 from a text file

awk:

awk '{if ((NR > n1) && (NR < n2)) print $0}' text_file_name

perl:

perl -ne 'print n1..n2' text_file_name

How to simulate process hang in Linux

To simulate the process hang, you can use the kill command with SIGSTOP signal

for example:

kill -SIGSTOP pid

My  case:

I tried to recreate the MQ client process hang and didn't reply the heartbeat packet to qmgr to see we can get what kind of error in qmgr error log.
.
step 1: start MQ client

#./amqsputc LQ1 QM1

step 2: find out the pid

#ps -ef|grep amqsputc

step 3: send SIGSTOP to the pid
#kill -SIGSTOP pid

check the qmgr error log and I can find out the following error message
-----------------------------------------------------
AMQ9271: Channel 'svrconn' timed out.

EXPLANATION:
A timeout occurred while waiting to receive from the other end of channel
'svrconn'. The address of the remote end of the connection was
'192.168.xxx.xxx'.
ACTION:
The return code from the select() [TIMEOUT] 35 seconds call was 4 (X'4').
Record these values and tell the systems administrator.

-------------------------------------------------------

In this case, the qmgr will close the connection due to no response from MQ client after heartbeat interval. The MQ client will report 2009 error (connection broken, reset by peer) after come back from hang issue.

To continue the process, you can use kill with SIGCONT signal.