Use this task to restrict access to the /var/mqm directories and log files needed for WebSphere MQ as a JMS provider.
Why and when to perform this task
This procedure involves steps that you complete at different stages of installing and using IBM WebSphere Application Server, as described below. The steps are also described at appropriate points in other tasks, but are collected here for completeness.
This procedure applies only to the ordinary UNIX file system. If your site uses access-control lists, secure the files by using that mechanism. Any site-specific requirements can affect the desired owner, group and corresponding privileges. For example, on AIX, complete the following steps:
Steps for this task
As part of this stage, the installation program creates the /var/mqm/errors and /var/mqm/qmgrs/@SYSTEM/errors directories used to hold messaging logging files.
chmod 3777 /var/mqm/errors chown mqm:mqm /var/mqm/errors touch /var/mqm/errors/AMQERR01.LOG chown mqm:mqm /var/mqm/errors/AMQERR01.LOG chmod 666 /var/mqm/errors/AMQERR01.LOG touch /var/mqm/errors/AMQERR02.LOG chown mqm:mqm /var/mqm/errors/AMQERR02.LOG chmod 666 /var/mqm/errors/AMQERR02.LOG touch /var/mqm/errors/AMQERR03.LOG chown mqm:mqm /var/mqm/errors/AMQERR03.LOG chmod 666 /var/mqm/errors/AMQERR03.LOG
chmod 3777 /var/mqm/qmgrs/@SYSTEM/errors chown mqm:mqm /var/mqm/qmgrs/@SYSTEM/errors touch /var/mqm/qmgrs/@SYSTEM/errors/AMQERR01.LOG chown mqm:mqm /var/mqm/qmgrs/@SYSTEM/errors/AMQERR01.LOG chmod 666 /var/mqm/qmgrs/@SYSTEM/errors/AMQERR01.LOG touch /var/mqm/qmgrs/@SYSTEM/errors/AMQERR02.LOG chown mqm:mqm /var/mqm/qmgrs/@SYSTEM/errors/AMQERR02.LOG chmod 666 /var/mqm/qmgrs/@SYSTEM/errors/AMQERR02.LOG touch /var/mqm/qmgrs/@SYSTEM/errors/AMQERR03.LOG chown mqm:mqm /var/mqm/qmgrs/@SYSTEM/errors/AMQERR03.LOG chmod 666 /var/mqm/qmgrs/@SYSTEM/errors/AMQERR03.LOG
To restrict access to the server's directory and logging files, use the following commands:
chmod 3775 /var/mqm/qmgrs/long_server_name/errors chown mqm:mqm /var/mqm/qmgrs/long_server_name/errors touch /var/mqm/qmgrs/long_server_name/errors/AMQERR01.LOG chown mqm:mqm /var/mqm/qmgrs/long_server_name/errors/AMQERR01.LOG chmod 666 /var/mqm/qmgrs/long_server_name/errors/AMQERR01.LOG touch /var/mqm/qmgrs/long_server_name/errors/AMQERR02.LOG chown mqm:mqm /var/mqm/qmgrs/long_server_name/errors/AMQERR02.LOG chmod 666 /var/mqm/qmgrs/long_server_name/errors/AMQERR02.LOG touch /var/mqm/qmgrs/long_server_name/errors/AMQERR03.LOG chown mqm:mqm /var/mqm/qmgrs/long_server_name/errors/AMQERR03.LOG chmod 666 /var/mqm/qmgrs/long_server_name/errors/AMQERR03.LOG
Where long_server_name is the long name assigned to the server, in the following form: WAS_nodename_server_name. For example, if you created an application server called server1 to run on the node called appnode1, the long server name would be: WAS_appnode1_server1.
Result
This task has restricted access to the /var/mqm directories and log files needed for WebSphere MQ as a JMS provider, such that only the user ID mqm or members of the mqm user group have write access.