{"id":1171,"date":"2022-02-22T18:50:42","date_gmt":"2022-02-22T18:50:42","guid":{"rendered":"https:\/\/marketaylor.synology.me\/?p=1171"},"modified":"2022-02-24T11:10:18","modified_gmt":"2022-02-24T11:10:18","slug":"obsolete-mq-channel-option","status":"publish","type":"post","link":"https:\/\/marketaylor.synology.me\/?p=1171","title":{"rendered":"A obsolete MQ channel option saved the day"},"content":{"rendered":"\n

After recovering from a site-wide power failure and restart, something then went wrong with my AIX system so that I could no longer log into it. It seemed that the ssh <\/strong>service had died. And none of the other standard Unix services like telnet <\/strong>were enabled for security reasons. I’ll show how I was able to recover, and how an obsolete MQ channel option saved the day.<\/p>\n\n\n\n\n\n\n\n

Since this is a virtual machine, where I don’t have access to the “real” console, how could I recover? Possibly raising a helpdesk ticket would get someone involved who could restart the system in maintenance mode and then solve whatever caused the problem. But that was not guaranteed. <\/p>\n\n\n\n

Investigating the pieces<\/h3>\n\n\n\n

The only normal service I could still use was ftp<\/strong>. That was enough to be able to put and get files. So I thought about editing \/etc\/inetd.conf<\/em> to reenable telnetd <\/strong>temporarily. But on AIX, that file is only read at startup or when a command runs to force it to be reread. So not helpful. And I couldn’t issue any commands remotely – just as telnet <\/strong>was disabled, so was rexec<\/strong>.<\/p>\n\n\n\n

What I noticed however when I looked at the copied inetd.conf<\/em> file, was that I did have an old-style MQ channel responder configured. The original MQ design for Unix systems did not have a product-provided listener. Instead, you used inetd.conf <\/em>to define and start an instance of the amqcrsta <\/strong>program – inetd <\/strong>being the general system-wide listener, and amqcrsta <\/strong>being a real MQ channel program. A new instance of amqcrsta <\/strong>was started by the daemon for each inbound channel. The MQ listener program runmqlsr <\/strong>was introduced to Unix systems after just a couple of releases but some people continued to use the inetd <\/strong>configuration because that was what they were used to. I think that I might have simply been checking that it still worked, even at MQ 7.1 which was what I had defined in the inetd <\/strong>configuration.<\/p>\n\n\n\n

So I could do telnet <system> 1212<\/code> and get connected to the channel – that connectivity was still working even if seemingly useless from the perspective of restarting sshd<\/strong>. Then I realised that the directory where I had installed that old version of MQ was mountable to another machine over NFS. And because I have a very permissive environment within my own systems, I had root authority over that remote filesystem. I also had sudo configured on the AIX box for passwordless access for the mqm <\/em>account. All these pieces gave me an idea.<\/p>\n\n\n\n

The solution<\/h3>\n\n\n\n

“All” I needed to do was to replace the amqcrsta <\/strong>binary with another program – a shell script – that contained the command to respond as a telnet session. Basically it looked like<\/p>\n\n\n\n

#!\/bin\/sh\nsudo \/usr\/sbin\/telnetd $*<\/pre>\n\n\n\n
Then use telnet <\/strong>to connect to the port, and instead of starting an MQ channel process, my shell script came up, and I got a basic command line that let me log in and do some proper recovery. I still don’t know why sshd originally died, but I’ve added configuration to auto-restart it if it fails in future. And I’ve restored the original version of amqcrsta.<\/p>\n\n\n\n
Conclusion<\/h3>\n\n\n\n
This might sound like a security vulnerability, but it’s not really because of all the things I had setup already that gave me so much remote power across a small number of platforms. But I thought it was interesting how something that was deprecated so many years ago could be subverted.<\/p>\n\n\n\n
<\/p>\n
This post was last updated on February 24th, 2022 at 11:10 am<\/p>","protected":false},"excerpt":{"rendered":"
After recovering from a site-wide power failure and restart, something then went wrong with my AIX system so that I could no longer log into it. It seemed that the ssh service had died. And none of the other standard Unix services like telnet were enabled for security reasons. I’ll show how I was able … Continue reading “A obsolete MQ channel option saved the day”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":1007,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[102],"tags":[35,104],"class_list":["post-1171","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-anecdotage","tag-ibmmq","tag-security"],"yoast_head":"\nA obsolete MQ channel option saved the day - Mark Taylor's Blog<\/title>\n<meta name=\"description\" content=\"An obsolete MQ channel option saved the day when I could no longer log into a development machine. This post shows how.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/marketaylor.synology.me\/?p=1171\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"A obsolete MQ channel option saved the day - Mark Taylor's Blog\" \/>\n<meta property=\"og:description\" content=\"An obsolete MQ channel option saved the day when I could no longer log into a development machine. This post shows how.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/marketaylor.synology.me\/?p=1171\" \/>\n<meta property=\"og:site_name\" content=\"Mark Taylor's Blog\" \/>\n<meta property=\"article:published_time\" content=\"2022-02-22T18:50:42+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-02-24T11:10:18+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/marketaylor.synology.me\/wp-content\/uploads\/2021\/10\/padlock-small.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"282\" \/>\n\t<meta property=\"og:image:height\" content=\"188\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Mark\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@marketaylor\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Mark\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1171#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1171\"},\"author\":{\"name\":\"Mark\",\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/#\\\/schema\\\/person\\\/2d6f4113ff54187023e20c20186bbb3c\"},\"headline\":\"A obsolete MQ channel option saved the day\",\"datePublished\":\"2022-02-22T18:50:42+00:00\",\"dateModified\":\"2022-02-24T11:10:18+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1171\"},\"wordCount\":590,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1171#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/marketaylor.synology.me\\\/wp-content\\\/uploads\\\/2021\\\/10\\\/padlock-small.jpg\",\"keywords\":[\"ibmmq\",\"security\"],\"articleSection\":[\"Anecdotage\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1171#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1171\",\"url\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1171\",\"name\":\"A obsolete MQ channel option saved the day - Mark Taylor's Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1171#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1171#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/marketaylor.synology.me\\\/wp-content\\\/uploads\\\/2021\\\/10\\\/padlock-small.jpg\",\"datePublished\":\"2022-02-22T18:50:42+00:00\",\"dateModified\":\"2022-02-24T11:10:18+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/#\\\/schema\\\/person\\\/2d6f4113ff54187023e20c20186bbb3c\"},\"description\":\"An obsolete MQ channel option saved the day when I could no longer log into a development machine. This post shows how.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1171#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1171\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1171#primaryimage\",\"url\":\"https:\\\/\\\/marketaylor.synology.me\\\/wp-content\\\/uploads\\\/2021\\\/10\\\/padlock-small.jpg\",\"contentUrl\":\"https:\\\/\\\/marketaylor.synology.me\\\/wp-content\\\/uploads\\\/2021\\\/10\\\/padlock-small.jpg\",\"width\":282,\"height\":188,\"caption\":\"padlock\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=1171#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/marketaylor.synology.me\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"A obsolete MQ channel option saved the day\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/#website\",\"url\":\"https:\\\/\\\/marketaylor.synology.me\\\/\",\"name\":\"Mark Taylor's Blog\",\"description\":\"Messaging, Music and Moving Around\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/marketaylor.synology.me\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/#\\\/schema\\\/person\\\/2d6f4113ff54187023e20c20186bbb3c\",\"name\":\"Mark\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9a5ae091c43730194cba7cabb5d65c1dc3f48d05caaddec6ff2319a1ce66376f?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9a5ae091c43730194cba7cabb5d65c1dc3f48d05caaddec6ff2319a1ce66376f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9a5ae091c43730194cba7cabb5d65c1dc3f48d05caaddec6ff2319a1ce66376f?s=96&d=mm&r=g\",\"caption\":\"Mark\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/marketaylor\"],\"url\":\"https:\\\/\\\/marketaylor.synology.me\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"A obsolete MQ channel option saved the day - Mark Taylor's Blog","description":"An obsolete MQ channel option saved the day when I could no longer log into a development machine. This post shows how.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/marketaylor.synology.me\/?p=1171","og_locale":"en_GB","og_type":"article","og_title":"A obsolete MQ channel option saved the day - Mark Taylor's Blog","og_description":"An obsolete MQ channel option saved the day when I could no longer log into a development machine. This post shows how.","og_url":"https:\/\/marketaylor.synology.me\/?p=1171","og_site_name":"Mark Taylor's Blog","article_published_time":"2022-02-22T18:50:42+00:00","article_modified_time":"2022-02-24T11:10:18+00:00","og_image":[{"width":282,"height":188,"url":"https:\/\/marketaylor.synology.me\/wp-content\/uploads\/2021\/10\/padlock-small.jpg","type":"image\/jpeg"}],"author":"Mark","twitter_card":"summary_large_image","twitter_creator":"@marketaylor","twitter_misc":{"Written by":"Mark","Estimated reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/marketaylor.synology.me\/?p=1171#article","isPartOf":{"@id":"https:\/\/marketaylor.synology.me\/?p=1171"},"author":{"name":"Mark","@id":"https:\/\/marketaylor.synology.me\/#\/schema\/person\/2d6f4113ff54187023e20c20186bbb3c"},"headline":"A obsolete MQ channel option saved the day","datePublished":"2022-02-22T18:50:42+00:00","dateModified":"2022-02-24T11:10:18+00:00","mainEntityOfPage":{"@id":"https:\/\/marketaylor.synology.me\/?p=1171"},"wordCount":590,"commentCount":0,"image":{"@id":"https:\/\/marketaylor.synology.me\/?p=1171#primaryimage"},"thumbnailUrl":"https:\/\/marketaylor.synology.me\/wp-content\/uploads\/2021\/10\/padlock-small.jpg","keywords":["ibmmq","security"],"articleSection":["Anecdotage"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/marketaylor.synology.me\/?p=1171#respond"]}]},{"@type":"WebPage","@id":"https:\/\/marketaylor.synology.me\/?p=1171","url":"https:\/\/marketaylor.synology.me\/?p=1171","name":"A obsolete MQ channel option saved the day - Mark Taylor's Blog","isPartOf":{"@id":"https:\/\/marketaylor.synology.me\/#website"},"primaryImageOfPage":{"@id":"https:\/\/marketaylor.synology.me\/?p=1171#primaryimage"},"image":{"@id":"https:\/\/marketaylor.synology.me\/?p=1171#primaryimage"},"thumbnailUrl":"https:\/\/marketaylor.synology.me\/wp-content\/uploads\/2021\/10\/padlock-small.jpg","datePublished":"2022-02-22T18:50:42+00:00","dateModified":"2022-02-24T11:10:18+00:00","author":{"@id":"https:\/\/marketaylor.synology.me\/#\/schema\/person\/2d6f4113ff54187023e20c20186bbb3c"},"description":"An obsolete MQ channel option saved the day when I could no longer log into a development machine. This post shows how.","breadcrumb":{"@id":"https:\/\/marketaylor.synology.me\/?p=1171#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/marketaylor.synology.me\/?p=1171"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/marketaylor.synology.me\/?p=1171#primaryimage","url":"https:\/\/marketaylor.synology.me\/wp-content\/uploads\/2021\/10\/padlock-small.jpg","contentUrl":"https:\/\/marketaylor.synology.me\/wp-content\/uploads\/2021\/10\/padlock-small.jpg","width":282,"height":188,"caption":"padlock"},{"@type":"BreadcrumbList","@id":"https:\/\/marketaylor.synology.me\/?p=1171#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/marketaylor.synology.me\/"},{"@type":"ListItem","position":2,"name":"A obsolete MQ channel option saved the day"}]},{"@type":"WebSite","@id":"https:\/\/marketaylor.synology.me\/#website","url":"https:\/\/marketaylor.synology.me\/","name":"Mark Taylor's Blog","description":"Messaging, Music and Moving Around","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/marketaylor.synology.me\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Person","@id":"https:\/\/marketaylor.synology.me\/#\/schema\/person\/2d6f4113ff54187023e20c20186bbb3c","name":"Mark","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/secure.gravatar.com\/avatar\/9a5ae091c43730194cba7cabb5d65c1dc3f48d05caaddec6ff2319a1ce66376f?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/9a5ae091c43730194cba7cabb5d65c1dc3f48d05caaddec6ff2319a1ce66376f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9a5ae091c43730194cba7cabb5d65c1dc3f48d05caaddec6ff2319a1ce66376f?s=96&d=mm&r=g","caption":"Mark"},"sameAs":["https:\/\/x.com\/marketaylor"],"url":"https:\/\/marketaylor.synology.me\/?author=1"}]}},"jetpack_featured_media_url":"https:\/\/marketaylor.synology.me\/wp-content\/uploads\/2021\/10\/padlock-small.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=\/wp\/v2\/posts\/1171","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1171"}],"version-history":[{"count":5,"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=\/wp\/v2\/posts\/1171\/revisions"}],"predecessor-version":[{"id":1178,"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=\/wp\/v2\/posts\/1171\/revisions\/1178"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=\/wp\/v2\/media\/1007"}],"wp:attachment":[{"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1171"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1171"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1171"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}