Securing IBM MQ

Security is an important consideration for both developers of IBM® MQ applications, and for IBM MQ system administrators.

Security updates
Ensure that all hardware and software inside the secure zone and on operator workstations are within their support lifecycle, have been upgraded with mandatory software updates and have had security updates promptly applied.
Security overview
This collection of topics introduces the IBM MQ security concepts.
Planning for your security requirements
This collection of topics explains what you need to consider when planning security in an IBM MQ environment.
Setting up security
This collection of topics contains information specific to different operating systems, and to the use of clients.
Identifying and authenticating users
You can identify and authenticate users by using X.509 certificates, the MQCSP structure or in several types of user exit program.
Authorizing access to objects
This section contains information about using the object authority manager and channel exit programs to control access to objects.
LDAP authorization
You can use LDAP authorization to remove the need for a local user ID.
Confidentiality of messages
Encrypting messages ensures that the contents of messages remains confidential. There are various methods of encrypting messages in IBM MQ depending on your needs.
Confidentiality for data at rest on IBM MQ for z/OS with data set encryption
IBM MQ for z/OS® can harden customer and configuration data by writing the data to the active log data sets, the archive log data sets, page sets, boot strap data sets (BSDS), and shared message data sets (SMDS).
Data integrity of messages
To maintain data integrity, you can use various types of user exit program to provide message digests or digital signatures for your messages.
Auditing
You can check for security intrusions, or attempted intrusions, by using event messages. You can also check the security of your system by using the IBM MQ Explorer.
Keeping clusters secure
Authorize or prevent queue managers joining clusters or putting messages on cluster queues. Force a queue manager to leave a cluster. Take account of some additional considerations when configuring TLS for clusters.
Publish/subscribe security
The components and interactions that are involved in publish/subscribe are described as an introduction to the more detailed explanations and examples that follow.
IBM MQ Console and REST API security
Security for the IBM MQ Console and the REST API is configured by editing the mqweb server configuration in the mqwebuser.xml file.
Managing keys and certificates on AIX, Linux, and Windows
On AIX®, Linux®, and Windows, use the runmqckm and runmqakm commands to manage keys, certificates, and certificate requests.
Protecting passwords in IBM MQ component configuration files
In order to use certain features of IBM MQ, passwords might have to be supplied either directly into IBM MQ or inside configuration files read by that feature. From IBM MQ 9.2.0, a new password protection system is implemented that allows the protection of passwords within these configuration files.
Protection of database authentication details
If your are using user name and password authentication to connect to the database manager, you can store them in the MQ XA credentials store to avoid storing the password in plain text in the qm.ini file.
Securing Managed File Transfer
Directly after installation and with no modification, Managed File Transfer has a level of security that might be suitable for test or evaluation purposes in a protected environment. However, in a production environment, you must consider appropriately controlling who can start file transfer operations, who can read and write the files being transferred, and how to protect the integrity of files.
Securing AMQP clients
You use a range of security mechanisms to secure connections from AMQP clients and ensure data is suitably protected on the network. You can build security into your MQ Light applications. You can also use existing security features of IBM MQ with AMQP clients, in the same way that the features are used for other applications.
Advanced Message Security
Advanced Message Security (AMS) is a component of IBM MQ that provides a high level of protection for sensitive data flowing through the IBM MQ network, while not impacting the end applications.