text:
|Thread Tools
|Display Modes
Befor I ever had a fuel pump problem I had ran my boat on empty many times to the point were I actually ran out of gas at least three times. I actually had to put a gallon in just to get to the gas station. I have a short trip from my marinia and were I ride with a gas station on the way, so when I read all this buisness about not running under a 1/4 tank I was curious as to why that is.
Then I seen that it only applied to the newer MC's. After closer inspection, I noticed the new MC's only have one line from the module to the motor and mine has two, supply and return. When my boat is below a quarter tank and I turn my key on the pump primes the lines and dumps back in to the canister. While running it, it continues to fill the canister above the tank fuel level, because the pump rate is faster then the fuel will excape from the bottom of the filter. If you have ever pulled your model you see that the fuel dosen't exit the canister to quickly. This keeps my canister full which submerges the pump in fuel to keep it cool. Since In the new MC's you don't have a return line, I would suspect that the pump will continue to pull only the fuel through the filter, in low fuel situations, leaving the pump exposed, without the fuel in the canister it has a less cooling property's surrounding the pump, hense over heating. NOt sure but something someone should look in to.
Maybe someone with the singal line setup can try and run their boat at a half tank and pull their regulator off the top of the module to see if the canister is full. On my boat I was at a 1/4 tank and the fuel almost overflowed out of the whole on top the module (were the regulator was).
boofer...excellent post. Very nice pictures. I actually just replaced my fuel pump a few weeks ago (pump only). I can honestly say I wouldn't have been able to complete the job correctly with out the help from everyone on this board.
To some golfers, the greatest handicap is the ability to add correctly.
Keep up the good work!
Bigmac, I am pretty certain that the filter is not restricting the flow of fuel at any level. I poured gas into a pan to about 3 inches deep. I placed the filter in the pan and it immediately filled up with gas. I was expecting to see it trickle in, but that was not the case. The level of the gas inside the filter equaled the level of gas on the outside of the filter within milliseconds. So, the filter does not restrict fuel. By the way, this is the replacement filter I used on my old module only a few months ago prior to replacing the whole fuel module. The new module came with a new filter.
I am really puzzled though by this small black disk. I cannot see any useful purpose. I basically used the same pan of gas. I slowly sunk the bottom of the module in the pan of gas (without the pump so that I could see the gas). Gas would not populate the small area at the bottom of the module until the module was all the way in the gas. I cannot recall now if I had the filter attached. I do not think that it was attached since I was trying to see what effect this disk has on flow to the pump. Basically the disk floats. When there is sufficient gas to float it, it will unplug the hole allowing fuel to go to the pump. If it is not floating the hole is closed and fuel will not get to the pump. Plus, I would gander that the pump is able to somewhat pull this small "valve" open when it is running. But, that would make it a restriction. I cannot really say one way or the other what the purpose of this disk is. It would keep air out of the pump at low fuel levels. But, regardless, air in the pump or no fuel available to the pump equals overheat.
Bear, it is the fuel that goes through the pump that cools the pump. The fuel on the outside can aide in cooling, but the pump is designed to be actively cooled by the flow of fuel through the pump.
I am 50/50 with that "newer" fuel hose form the pump to the regulator. The old hose was definitely "substantial," but it did have the noticeable kink. The new hose is much stiffer than it looks. And it flexes well. I wonder if the corrugation helps reduce the flow to the regulator and eases the job of the regulator without creating any backpressure. But, one of the board members posted his problems with the dual pump (Milinium?) setup on his boat. Here is the link to his post. http://www.mastercraft.com/teamtalk/...ight=fuel+hose
Remember, the Carter brochure is just that; a brochure. The electrical issue (melted contacts) was experienced by a board member. He posted pictures just recently. But, I did learn that the pump was too restrictive and easily clogged which led to the high failure rate. I believe that I found this while researching the GM problems with the Carter pumps and the MC representative echoed the same information to me in the email. The pump was redesigned to be less restrictive and more tolerant of debris. When I say "debris," we are talking microscopic.
What I see for now is a poorly designed pump. It was replaced in GM motors. So, why not do it in ours? I am still awaiting a reply to my question as to whether or not my new module came with the newer turbine style pump. If not, then I must really question MC's policies. They apparently thought there was enough of a problem to use a different pump(s) on newer boats. If they are not actively trying to get these newer pumps in older boats (replacement modules with the newer pumps) then I must call foul.
Common sense is the least common of all the senses.
Last edited by boofer; 08-11-2008 at 03:21 PM.
Kudos Boofer, great post !!!
I own a 2006 X-45 with an L-18 engine. Last week I had to change my fuel pump the second time (same happened last summer during a storm ). Let's say, I am somehow experienced replacing the fuel pump.
Because my MC is out of warranty, I tried to find out if I can get this tiny fuel pump somewhere without replacing the whole kit (and being charged with 600 EUR, roughly 900 USD).
I was lucky, the MEAT & DORIA 76201 is exactly the fuel pump I needed, bought in a standard car parts shop in Salò (Lake Garda, Italy) for small money. Obviously this pump is standard in Fiat automobiles.
My analysis: both pumps has been burned due to lack of cooling or bad manufacturing quality. I never ever ran my boat below 1/4 tank. This "floating disk" valve might be the key for all problems. If this valve is not floating properly, the container reservoir will not be filled properly with enough fuel, the pump run out of fuel and cooling.
Great follow up on the fuel pump Boofer!! I have a new pump still in the box from MC, and will be returning to my boat next week to install.. Thanks to your thread I am able to handle this myself thus saving me a fortune on labor and a ton of gas not having to tow to the shop. I will print the pictures for an intallation guide and pull apart the old pump to see if it has any of the issues discussed here.
You have a VIP privaleges any time you are in Lake Cumberland!! Just look me up and I will spring for free rides and beverages.
I must caution you about using an aftermarket pump. Just because it may fit does not mean that it is able to meet the demands of your motor. Please be careful!!!
Thanks for the kudos. I hope the install goes well for you. Just be real careful with the 12 bolts that go on the module. It took me several minutes to ease each bolt in correctly. Despite the fact that the tank was empty, the bolt holes did not align perfectly. I will take you up on your offer if I find my way to your neck of the woods.
Common sense is the least common of all the senses.
Okay boys and girls, this is getting a little deep.
I finally received a reply from MC. They said that the pump in my old module and in my new module should be the newer turbine style pump. They said that the change was made in the '02-'03 time frame.
So, is it a turbine style pump? I have emailed Carter/Federal Mogul and politely requested that they tell me how to determine if a pump is the turbine pump. I know from calling them that they have an agreement with MC to not reveal any detailed specifications. I am hoping that they will comply with my request since I can simply dismantle this pump and verify which kind of pump it is.
Now, if both pumps are the turbine style pumps, we are back to square one. I have been to the Federated store and spoke with the fellow I mentioned a while back. He has ordered a pump that he believes will work. I am going to try to get by there tomorrow and see what he has. When I showed him the complete fuel module he recognized it minus the top plate which is specific to our boats. He even showed me the filter in his catalog. But, he was unable to draw a specific cross reference based on any of the nomenclature on the pump or the module. The "71-342S" which is on the top plate mimics Carter part numbers (7x-xxx). I am also going to ask him if he can tell if my old pump is a turbine style pump.
I am not feeling any good vibes right now. I honestly think that both the old pump and the new pump are NOT the turbine style pumps. In the back of my mind I am thinking CALS. If it gets to that point, then at least maybe we can finally get some concrete answers and possibly a REAL fix.
Common sense is the least common of all the senses.
How did you ever cross reference that pump!? Good work. WHat is the GPH? or LPH? That would be your only other concern regarding capacity other than pressure.
|Thread Tools
|Display Modes
Linear Mode


text:
SP91027 Band w/guard tab
Band w/guard tab Will Fit Mark VI
Please note that over time the Mark 6 and Mark 7 instruments may have slight changes due to manufacturer or unknown repair history. This surplus of Selmer parts are sold as is and may require a professional musical instrument repairman to install. It is highly recommended to measure all parts you wish to replace to insure you receive a proper fit. You may also call or email us with any questions concerning our supply of Selmer parts.

subset: commoncrawl


text:
Summer Shoes For Pregnant Women
8 Maternity Must Haves For Your Summer Shoe Wardrobe
As POPSUGAR editors, we independently select and write about stuff we love and think you'll like too. POPSUGAR has affiliate and advertising partnerships so we get revenue from sharing this content and from your purchase.
8 Maternity Must Haves For Your Summer Shoe Wardrobe
You knew you were probably going to have to invest in some new maternity clothing for your growing belly, but you might not have realized that your shoe wardrobe would probably need a makeover as well! Many women experience foot swelling during pregnancy, especially during the hot Summer months, and find those dainty ballet flats and sky-high stilettos just aren't fitting like they used to (and we don't recommend squeezing into them like certain pregnant celebrities; we're talking about you, Kim!). Whether you need to invest in some new shoes due to growing feet or just want to shop for cute Summer sandals, check out our eight footwear essentials for a comfortable and stylish Summer pregnancy, and treat your feet!


text:
Rams Defeat Old Westbury in Memory of Dominic
Farmingdale State - 87, Old Westbury - 70
Farmingdale, N.Y. - The Farmingdale State men's basketball team had six players score in double-digits as the Rams defeated Skyline Conference rival Old Westbury, 87-70, this evening in Farmingdale, N.Y. Tonight's game, the "This is my Season" Tip Off, was a fundraiser for the Dominic A. Murray 21 Memorial Foundation, Inc. and a special night of ballin' for Heart Awareness to raise awareness of Sudden Cardiac Arrest (SCA).
Farmingdale State (13-8, 12-4 Skyline) held a 41-30 lead early in the second half, before the Panthers (8-12, 7-8 Skyline) went on a 13-4 run and cut the deficit to two with 15:39 remaining. Old Westbury trailed 50-49 with 11:44 to play, but a quick 15-2 run over the next 3:42, put the Rams ahead 65-51. Farmingdale State held a double-digit lead throughout the final eight minutes to earn the 87-70 Skyline victory.
Senior guard John Dabney (Freeport, N.Y./Freeport) and junior guard Dyshaun Flournoy (Brentwood, N.Y./Brentwood) led Farmingdale State with 15 points apiece, while junior forward Robert Adon (New York, N.Y./A. Philip Randolph) scored 13. Junior guard Joshua Smith (Deer Park, N.Y./Deer Park) pitched in with 12 points and junior guard Richard Payton (Amityville, N.Y./Amityville) and senior forward Jermaine Abraham (Brooklyn, N.Y./Wadleigh) scored 11 and 10 points, respectively.
Old Westbury was led by freshman guard Scott Arias (New York, N.Y./Rice) who recorded a game-high 20 points. Senior guard Tymel Ambrose (Brooklyn, N.Y./Grady) had nine assists and six rebounds in the loss.
Farmingdale State will travel to Purchase College for a Skyline matchup on Thursday, February 10th at 8:00 p.m.


text:
The Guardian
Goalline technology given early Championship debut in play-offs
• System to become permanent Championship fixture in 2017-18 season
• Premier League has been using the technology since 2013
The Championship play-off semi-finals in May will feature goalline technology before it becomes a fixture next season.
Originally scheduled for approval at June's English Football League annual general meeting, the use of the technology was confirmed at an extraordinary general meeting last week in order to give clubs more time to install the necessary infrastructure.
The earlier-than-expected start has enabled the League to confirm that the four play-off semi-final matches, played between 13 and 17 May, will also have the system in place.
The technology has been used in the Premier League since 2013, as well as in some League Cup ties and the EFL play-off finals at Wembley.
Shaun Harvey, the EFL chief executive, said: "The introduction of goalline technology is a significant step forward for Championship clubs and reflects the importance of the outcome of every single game in the division. Goalline technology has proved to be popular and effective in the Premier League as well as other mainstream sports. I am sure it will also become a welcome and useful addition to our broadcast coverage."
Will this favour any particular team, and are you in favour of it?
Goalline technology in Championship Play-offs
Discuss all things football and non-rovers related
Post Reply
1 post • Page 1 of 1
Post Reply
1 post • Page 1 of 1


text:
This chapter describes Message Queue's facilities for security-related administration tasks, such as configuring user authentication, defining access control, configuring a Secure Socket Layer (SSL) connection service to encrypt client-broker communication, and setting up a password file for administrator account passwords. In addition to Message Queue's own built-in authentication mechanisms, you can also plug in a preferred external service based on the Java Authentication and Authorization Service (JAAS) API.
This chapter includes the following sections:
Message Queue provides security services for user access control (authentication and authorization) and for encryption:
Authentication ensures that only verified users can establish a connection to a broker.
Authorization specifies which users or groups have the right to access resources and to perform specific operations.
Encryption protects messages from being tampered with during delivery over a connection.
As a Message Queue administrator, you are responsible for setting up the information the broker needs to authenticate users and authorize their actions. The broker properties pertaining to security services are listed under Security Properties. The boolean property imq.accesscontrol.enabled acts as a master switch that controls whether access control is applied on a brokerwide basis; for finer control, you can override this setting for a particular connection service by setting the imq.serviceName .accesscontrol.enabled property, where serviceName is the name of the connection service, as shown in Table 6–1: for example, imq.httpjms.accesscontrol.enabled.
The following figure shows the components used by the broker to provide authentication and authorization services. These services depend on a user repository containing information about the users of the messaging system: their names, passwords, and group memberships. In addition, to authorize specific operations for a user or group, the broker consults an access control file that specifies which operations a user or group can perform. You can designate a single access control file for the broker as a whole, using the configuration property imq.accesscontrol.file.filename, or for a single connection service with imq.serviceName. accesscontrol.file.filename.
As Figure 9–1 shows, you can store user data in a flat file user repository that is provided with the Message Queue service, you can access an existing LDAP repository, or you can plug in a Java Authentication and Authorization Service (JAAS) module.
If you choose a flat-file repository, you must use the imqusermgr utility to manage the repository. This option is easy to use and built-in.
If you want to use an existing LDAP server, you use the tools provided by the LDAP vendor to populate and manage the user repository. You must also set properties in the broker instance configuration file to enable the broker to query the LDAP server for information about users and groups.
The LDAP option is better if scalability is important or if you need the repository to be shared by different brokers. This might be the case if you are using broker clusters.
If you want to plug-in an existing JAAS authentication service, you need to set the corresponding properties in the broker instance configuration file.
The broker's imq.authentication.basic.user_repository property specifies which type of repository to use. In general, an LDAP repository or JAAS authentication service is preferable if scalability is important or if you need the repository to be shared by different brokers (if you are using broker clusters, for instance). See User Authentication for more information on setting up a flat-file user repository, LDAP access, or JAAS authentication service.
A client requesting a connection to a broker must supply a user name and password, which the broker compares with those stored in the user repository. Passwords transmitted from client to broker are encoded using either base-64 encoding (for flat-file repositories) or message digest (MD5) hashing (for LDAP repositories). The choice is controlled by the imq.authentication.type property for the broker as a whole, or by imq.serviceName. authentication.type for a specific connection service. The imq.authentication.client.response.timeout property sets a timeout interval for authentication requests.
As described under Password Files, you can choose to put your passwords in a password file instead of being prompted for them interactively. The boolean broker property imq.passfile.enabled controls this option. If this property is true, the imq.passfile.dirpath and imq.passfile.name properties give the directory path and file name for the password file. The imq.imqcmd.password property (which can be embedded in the password file) specifies the password for authenticating an administrative user to use the Command utility (imqcmd) for managing brokers, connection services, connections, physical destinations, durable subscriptions, and transactions.
If you are using an LDAP-based user repository, there are a whole range of broker properties available for configuring various aspects of the LDAP lookup. The address (host name and port number) of the LDAP server itself is specified by imq.user_repository.ldap.server. The imq.user_repository.ldap.principal property gives the distinguished name for binding to the LDAP repository, while imq.user_repository.ldap.password supplies the associated password. Other properties specify the directory bases and optional JNDI filters for individual user and group searches, the provider-specific attribute identifiers for user and group names, and so forth; see Security Properties for details.
Once authenticated, a user can be authorized to perform various Message Queue-related activities. As a Message Queue administrator, you can define user groups and assign individual users membership in them. The default access control file explicitly refers to only one group, admin (see User Groups and Status). A user in this group has connection permission for the admin connection service, which allows the user to perform administrative functions such as creating destinations and monitoring and controlling a broker. A user in any other group that you define cannot, by default, get an admin service connection.
When a user attempts to perform an operation, the broker checks the user's name and group membership (from the user repository) against those specified for access to that operation (in the access control file). The access control file specifies permissions to users or groups for the following operations:
Connecting to a broker
Accessing destinations: creating a consumer, a producer, or a queue browser for any given destination or for all destinations
For information on configuring authorization, see User Authorization
To encrypt messages sent between clients and broker, you need to use a connection service based on the Secure Socket Layer (SSL) standard. SSL provides security at the connection level by establishing an encrypted connection between an SSL-enabled broker and client.
To use an SSL-based Message Queue connection service, you generate a public/private key pair using the Message Queue Key Tool utility (imqkeytool). This utility embeds the public key in a self-signed certificate and places it in a Message Queue key store. The key store is itself password-protected; to unlock it, you must provide a key store password at startup time, specified by the imq.keystore.password property. Once the key store is unlocked, a broker can pass the certificate to any client requesting a connection. The client then uses the certificate to set up an encrypted connection to the broker.
For information on configuring encryption, see Message Encryption
Users attempting to connect to a Message Queue message broker must provide a user name and password for authentication. The broker will grant the connection only if the name and password match those in a broker-specific user repository listing the authorized users and their passwords. Each broker instance can have its own user repository, which you as an administrator are responsible for maintaining. This section tells how to create, populate, and manage the user repository.
Message Queue can support any of three types of authentication mechanism:
A flat-file repository that is shipped with Message Queue. This type of repository is very easy to populate and manage, using the Message Queue User Manager utility (imqusermgr). See Using a Flat-File User Repository.
A Lightweight Directory Access Protocol (LDAP) server. This could be a new or existing LDAP directory server using the LDAP v2 or v3 protocol. You use the tools provided by the LDAP vendor to populate and manage the user repository. This type of repository is not as easy to use as the flat-file repository, but it is more scalable and therefore better for production environments. See Using an LDAP User Repository.
An external authentication mechanism plugged into Message Queue by means of the Java Authentication and Authorization Service (JAAS) API. See Using JAAS-Based Authentication.
Message Queue provides a built-in flat-file user repository and a command line tool, the User Manager utility (imqusermgr), for populating and managing it. Each broker has its own flat-file user repository, created automatically when you start the broker. The user repository resides in a file named passwd, in a directory identified by the name of the broker instance with which the repository is associated:
(See Appendix A, Distribution-Specific Locations of Message Queue Data for the exact location of the instances directory, depending on your operating system platform.)
Each user in the repository can be assigned to a user group, which defines the default access privileges granted to all of its members. You can then specify authorization rules to further restrict these access privileges for specific users, as described in User Authorization. A user's group is assigned when the user entry is first created, and cannot be changed thereafter. The only way to reassign a user to a different group is to delete the original user entry and add another entry specifying the new group.
The flat-file user repository provides three predefined groups:
For broker administrators. By default, users in this group are granted the access privileges needed to configure, administer, and manage message brokers.
For normal (non-administrative) client users. Newly created user entries are assigned to this group unless otherwise specified. By default, users in this group can connect to all Message Queue connection services of type NORMAL, produce messages to or consume messages from all physical destinations, and browse messages in any queue.
For Message Queue clients that do not wish to use a user name known to the broker (for instance, because they do not know of a real user name to use). This group is analogous to the anonymous account provided by most FTPservers. No more than one user at a time can be assigned to this group. You should restrict the access privileges of this group in comparison to the user group, or remove users from the group at deployment time.
You cannot rename or delete these predefined groups or create new ones.
In addition to its group, each user entry in the repository has a user status: either active or inactive. New user entries added to the repository are marked active by default. Changing a user's status to inactive rescinds all of that user's access privileges, making the user unable to open new broker connections. Such inactive entries are retained in the user repository, however, and can be reactivated at a later time. If you attempt to add a new user with the same name as an inactive user already in the repository, the operation will fail; you must either delete the inactive user entry or give the new user a different name.
To allow the broker to be used immediately after installation without further intervention by the administrator, the flat-file user repository is created with two initial entries, summarized in Table 9–1:
The admin entry (user name and password admin/admin) enables you to administer the broker with Command utility (imqcmd) commands. Immediately on installation, you should update this initial entry to change its password (see Changing a User's Password).
The guest entry allows clients to connect to the broker using a default user name and password (guest/guest).
You can then proceed to add any additional user entries you need for individual users of your message service.Table 9–1 Initial Entries in Flat-File User Repository
User Name
The Message Queue User Manager utility (imqusermgr) enables you to populate or edit a flat-file user repository. SeeUser Manager Utility for general reference information about the syntax, subcommands, and options of the imqusermgr command.
Before using the User Manager, keep the following things in mind:
The imqusermgr command must be run on the host where the broker is installed.
If a broker-specific user repository does not yet exist, you must start up the corresponding broker instance to create it.
You must have appropriate permissions to write to the repository; in particular, on Solaris and Linux platforms, you must be logged in as the root user or the user who first created the broker instance.
Table 9–2 lists the subcommands of the imqusermgr command. For full reference information about these subcommands, see Table 16–15.Table 9–2 User Manager Subcommands
Add user and password to repository
Delete user from repository
Set user's password or active status (or both)
Display user information
The general options listed in Table 9–3 apply to all subcommands of the imqusermgr command.Table 9–3 General User Manager Options
Perform action without user confirmation
Silent mode (no output displayed)
Display version information [Any other options specified on the command line are ignored. ]
Display usage help
To display the Message Queue product version, use the -v option. For example:
imqusermgr -v
If you enter an imqusermgr command line containing the -v option in addition to a subcommand or other options, the User Manager utility processes only the -v option. All other items on the command line are ignored.
To display help on the imqusermgr command, use the -h option, and do not use a subcommand. You cannot get help about specific subcommands.
For example, the following command displays help about imqusermgr:
imqusermgr -h
If you enter an imqusermgr command line containing the -h option in addition to a subcommand or other options, the Command utility processes only the -h option. All other items on the command line are ignored.
The subcommand imqusermgr add adds an entry to the user repository, consisting of a user name and password:
imqusermgr add [-i brokerName] -u userName -p password [-g group]
The -u and -p options specify the user name and password, respectively, for the new entry. These must conform to the following conventions:
All user names and passwords must be at least one character long. Their maximum length is limited only by command shell restrictions on the maximum number of characters that can be entered on a command line.
A user name cannot contain an asterisk (*), a comma (,), a colon (:), or a new-line or carriage-return character.
If a user name or password contains a space, the entire name or password must be enclosed in quotation marks (" ").
The optional -g option specifies the group (admin, user, or anonymous) to which the new user belongs; if no group is specified, the user is assigned to the user group by default. If the broker name (-i option) is omitted, the default broker imqbroker is assumed.
For example, the following command creates a user entry on broker imqbroker for a user named AliBaba, with password Sesame, in the admin group:
imqusermgr add -u AliBaba -p Sesame -g admin
The subcommand imqusermgr delete deletes a user entry from the repository:
imqusermgr delete [-i brokerName] -u userName
The -u option specifies the user name of the entry to be deleted. If the broker name (-i option) is omitted, the default broker imqbroker is assumed.
For example, the following command deletes the user named AliBaba from the user repository on broker imqbroker:
imqusermgr delete -u AliBaba
You can use the subcommand imqusermgr update to change a user's password:
imqusermgr update [-i brokerName] -u userName -p password
The -u identifies the user; -p specifies the new password. If the broker name (-i option) is omitted, the default broker imqbroker is assumed.
For example, the following command changes the password for user AliBaba to Shazam on broker imqbroker:
imqusermgr update -u AliBaba -p Shazam
For the sake of security, you should change the password of the admin user from its initial default value (admin) to one that is known only to you. The following command changes the default administrator password for broker mybroker to veeblefetzer:
imqusermgr update -i mybroker -u admin -p veeblefetzer
You can quickly confirm that this change is in effect by running any of the command line tools when the broker is running. For example, the following command will prompt you for a password:
imqcmd list svc mybroker -u admin
Entering the new password (veeblefetzer) should work; the old password should fail.
After changing the password, you should supply the new password whenever you use any of the Message Queue administration tools, including the Administration Console.
The imqusermgr update subcommand can also be used to change a user's active status:
imqusermgr update [-i brokerName] -u userName -a activeStatus
The -u identifies the user; -a is a boolean value specifying the user's new status as active (true) or inactive (false). If the broker name (-i option) is omitted, the default broker imqbroker is assumed.
For example, the following command sets user AliBaba's status to inactive on broker imqbroker:
imqusermgr update -u AliBaba -a false
This renders AliBabe unable to open new broker connections.
You can combine the -p (password) and -a (active status) options in the same imqusermgr update command. The options may appear in either order: for example, both of the following commands activate the user entry for AliBaba and set the password to plugh:
imqusermgr update -u AliBaba -p plugh -a true imqusermgr update -u AliBaba -a true -p plugh
The imqusermgr list command displays information about a user in the user repository:
imqusermgr list [-i brokerName] [-u userName]
The command
imqusermgr list -u AliBaba
displays information about user AliBabe, as shown in Example 9–1.
If you omit the -u option
imqusermgr list
the command lists information about all users in the repository, as in Example 9–2.
You configure a broker to use an LDAP directory server by setting the values for certain configuration properties in the broker's instance configuration file (config.properties). These properties enable the broker instance to query the LDAP server for information about users and groups when a user attempts to connect to the broker or perform messaging operations.
The imq.authentication.basic.user_repository property specifies the kind of user authentication the broker is to use. By default, this property is set to file, for a flat-file user repository. For LDAP authentication, set it to ldap instead:
The imq.authentication.type property controls the type of encoding used when passing a password between client and broker. By default, this property is set to digest, denoting MD5 encoding, the form used by flat-file user repositories. For LDAP authentication, set it to basic instead:
This denotes base-64 encoding, the form used by LDAP user repositories.
The following properties control various aspects of LDAP access. See Table 17–9 for more detailed information:
The imq.user_repository.ldap.userformat property, if set to a value of dn, specifies that the login username for authentication be in DN username format (for example: uid=mquser,ou=People,dc=red,dc=sun,dc=com). In this case, the broker extracts the value of the imq.user.repository.lpdap.uidatr attribute from the DN username, and uses this value as the user name in access control operations (see User Authorization).
If you want the broker to use a secure, encrypted SSL (Secure Socket Layer) connection for communicating with the LDAP server, set the broker's imq.user_repository.ldap.ssl.enabled property to true
and the imq.user_repository.ldap.server property to the port used by the LDAP server for SSL communication: for example,
You will also need to activate SSL communication in the LDAP server.
In addition, you may need to edit the user and group names in the broker's access control file to match those defined in the LDAP user repository; see User Authorization for more information.
For example, to create administrative users, you use the access control file to specify those users and groups in the LDAP directory that can create ADMIN connections.
Any user or group that can create an ADMIN connection can issue administrative commands.
The following procedure makes use of a broker's access control file, which is described in User Authorization.
Enable the use of the access control file by setting the broker property imq.accesscontrol.enabled to true, which is the default value.
The imq.accesscontrol.enabled property enables use of the access control file.
Open the access control file, accesscontrol.properties. The location for the file is listed in Appendix A, Distribution-Specific Locations of Message Queue Data
The file contains an entry such as the following:
service connection access control##################################connection.NORMAL.allow.user=*connection.ADMIN.allow.group=admin
The entries listed are examples. Note that the admin group exists by default in the file-based user repository but does not exist by default in the LDAP directory.
To grant Message Queue administrator privileges to users, enter the user names as follows:
connection.ADMIN.allow.user= userName[[,userName2] …]
The users must be defined in the LDAP directory.
To grant Message Queue administrator privileges to groups, enter the group names as follows:
connection.ADMIN.allow.group= groupName[[,groupName2] …]
The groups must be defined in the LDAP directory.
The Java Authentication and Authorization Service (JAAS) API allows you to plug an external authentication mechanism into Message Queue. This section describes the information that the Message Queue message broker makes available to a JAAS-compliant authentication service and explains how to configure the broker to use such a service. The following sources provide further information on JAAS:
For complete information about the JAAS API, see the Java™ Authentication and Authorization Service (JAAS) Reference Guide at the URL
For information about writing a JAAS login module, see the Java™ Authentication and Authorization Service (JAAS) LoginModule Developer's Guide at
JAAS is a core API in Java 2 Standard Edition (J2SE), and is therefore an integral part of Message Queue's runtime environment. It defines an abstraction layer between an application and an authentication mechanism, allowing the desired mechanism to be plugged in with no change to application code. In the case of the Message Queue service, the abstraction layer lies between the broker (application) and an authentication provider. By setting a few broker properties, it is possible to plug in any JAAS-compliant authentication service and to upgrade this service with no disruption or change to broker code.
You cannot use the Java Management Extensions (JMX) API to change JAAS-related broker properties. However, once JAAS-based authentication is configured, JMX client applications (like other clients) can be authenticated using this mechanism.
Figure 9–2 shows the basic elements of JAAS: a JAAS client, a JAAS-compliant authentication service, and a JAAS configuration file.
The JAAS client is an application wishing to perform authentication using a JAAS-compliant authentication service. The JAAS client communicates with the authentication service using one or more login modules and is responsible for providing a callback handler that the login module can call to obtain the user name, password, and other information needed for authentication.
The JAAS-compliant authentication service consists of one or more login modules along with logic to perform the needed authentication. The login module (LoginModule) may include the authentication logic itself, or it may use a private protocol or API to communicate with an external security service that provides the logic.
The JAAS configuration file is a text file that the JAAS client uses to locate the login module(s) to be used.
Figure 9–3 shows how JAAS is used by the Message Queue broker. It shows a more complex implementation of the JAAS model shown in Figure 9–2.
The authentication service layer, consisting of one or more login modules (if needed) and corresponding authentication logic, is separate from the broker. The login modules run in the same Java virtual machine as the broker. The broker is represented to the login module as a login context, and communicates with the login module by means of a callback handler that is part of the broker runtime code.
The authentication service also supplies a JAAS configuration file containing entries that reference the login modules. The configuration file specifies the order in which the login modules (if more than one) are to be used and any conditions for their use. When the broker starts up, it locates the configuration file by consulting either the Java system property java.security.auth.login.config or the Java security properties file. The broker then selects an entry in the JAAS configuration file according to the value of the broker property imq.user_repository.jaas.name. That entry specifies which login module(s) will be used for authentication. The classes for the login modules are found in the Message Queue external resource files directory, whose location depends on the operating system platform you are using; see Appendix A, Distribution-Specific Locations of Message Queue Data for details.
The relation between the configuration file, the login module, and the broker is shown in the following figure. Figure 9–4.
The fact that the broker uses a JAAS plug-in authentication service remains completely transparent to the Message Queue client. The client continues to connect to the broker as it did before, passing a user name and password. In turn, the broker uses a callback handler to pass login information to the authentication service, and the service uses the information to authenticate the user and return the results. If authentication succeeds, the broker grants the connection; if it fails, the client runtime returns a JMS security exception that the client must handle.
After the Message Queue client is authenticated, if there is further authorization to be done, the broker proceeds as it normally would, consulting the access control file to determine whether the authenticated client is authorized to perform the actions it undertakes: accessing a destination, consuming a message, browsing a queue, and so on.
Setting up JAAS-compliant authentication involves setting broker and system properties to select this type of authentication, to specify the location of the configuration file, and to specify the entries to the login modules that are going to be used.
To set up JAAS support for Message Queue, you perform the following general steps. (These steps assume you are creating your own authentication service.)
Create one or more login module classes that implement the authentication service. The JAAS callback types that the broker supports are listed below.
The broker uses this callback to pass the authentication service the locale in which the broker is running. This value can be used for localization.
The broker uses this callback to pass to the authentication service the user name specified by the Message Queue client when the connection was requested.
The broker uses this callback to pass the value of the following information to the login module (authentication service) when requested through the TextInputCallback.getPrompt() with the following strings:
imq.authentication.type: The broker authentication type in effect at runtime
imq.accesscontrol.type: The broker access control type in effect at runtime
imq.authentication.clientip: The client IP address (null if unavailable)
imq.servicename: The name of the connection service (jms, ssljms, admin, or ssladmin) being used by the client
imq.servicetype: The type of the connection service (NORMAL or ADMIN) being used by the client
The broker uses this callback to pass to the authentication service the password specified by the Message Queue client when the connection was requested.
The broker handles this callback to provide logging service to the authentication service by logging the text output to the broker's log file. The callback's MessageType ERROR, INFORMATION, WARNING are mapped to the broker logging levels ERROR, INFO, WARNING respectively.
Create a JAAS configuration file with entries that reference the login module classes created in Step 1 and specify the location of this file.
Note the name of the entry in the JAAS configuration file (that references the login module implementation classes).
Archive the classes that implement the login modules to a jar file, and place the jar file in the Message Queue lib/ext directory.
Set the broker configuration properties that relate to JAAS support. These are described in Table 9–4.
Set the following system property (to specify the location of the JAAS configuration file).
For example, you can specify the location when you start the broker.
imqbrokerd -Djava.security.auth.login.config=JAAS_Config_File_Location
There are other ways to specify the location of the JAAS configuration file. For additional information, please see
The following table lists the broker properties that need to be set to set up JAAS support.Table 9–4 Broker Properties for JAAS Support
Set to basic to indicate Base-64 password encoding. This is the only permissible value for JAAS authentication.
Set to jaas to specify JAAS authentication.
Set to the name of the desired entry (in the JAAS configuration file) that references the login modules you want to use as the authentication mechanism. This is the name you noted in Step 3.
This property, used by Message Queue access control, specifies the java.security.Principal implementation class in the login module(s) that the broker uses to extract the Principal name to represent the user entity in the Message Queue access control file. If, it is not specified, the user name passed from the Message Queue client when a connection was requested is used instead.
This property, used by Message Queue access control, specifies the java.security.Principal implementation class in the login module(s) that the broker uses to extract the Principal name to represent the group entity in the Message Queue access control file. If, it is not specified, the group rules, if any, in the Message Queue access control file are ignored.
An access control file contains rules that specify which users (or groups of users) are authorized to perform certain operations on a message broker. These operations include the following:
Creating a connection
Creating a message producer for a physical destination
Creating a message consumer for a physical destination
Browsing a queue destination
Auto-creating a physical destination
If access control is enabled (that is, if the broker's imq.accesscontrol.enabled configuration property is set to true, the broker will consult its access control file whenever a client attempts one of these operations, to verify whether the user generating the request (or a group to which the user belongs) is authorized to perform the operation. By editing this file, you can restrict access to these operations to particular users and groups. Changes take effect immediately; there is no need to restart the broker after editing the file.
Each broker has it own access control file, created automatically when the broker is started. The file is named accesscontrol.properties and is located at a path of the form
(See Appendix A, Distribution-Specific Locations of Message Queue Data for the exact location, depending on your platform.)
The file is formatted as a Java properties file. It starts with a version property defining the version of the file:
This is followed by three sections specifying the access control for three categories of operations:
Creating connections
Creating message producers or consumers, or browsing a queue destination
Auto-creating physical destinations
Each of these sections consists of a sequence of authorization rules specifying which users or groups are authorized to perform which specific operations. These rules have the following syntax:
Table 9–5 describes the various elements.Table 9–5 Authorization Rule Elements
Type of resource to which the rule applies:
connection: Connections
queue: Queue destinations
topic: Topic destinations
Specific resource (connection service type or destination) to which the rule applies
An asterisk (*) may be used as a wild-card character to denote all resources of a given type: for example, a rule beginning with queue.* applies to all queue destinations.
Operation to which the rule applies
This syntax element is not used for resourceType=connection.
Level of access authorized:
allow: Authorize user to perform operation
deny: Prohibit user from performing operation
Type of principal (user or group) to which the rule applies:
user: Individual user
group: User group
List of principals (users or groups) to whom the rule applies, separated by commas
An asterisk (*) may be used as a wild-card character to denote all users or all groups: for example, a rule ending with user=* applies to all users.
Rule: queue.q1.consume.allow.user=*
Description: allows all users to consume messages from the queue destination q1.
Rule: queue.*.consume.allow.user=Snoopy
Description: allows user Snoopy to consume messages from all queue destinations.
Rule: topic.t1.produce.deny.user=Snoopy
Description: prevents Snoopy from producing messages to the topic destination t1
You can use Unicode escape (\\uXXXX) notation to specify non-ASCII user, group, or destination names. If you have edited and saved the access control file with these names in a non-ASCII encoding, you can use the Java native2ascii tool to convert the file to ASCII. See the Java Internationalization FAQ at
for more information.
Authorization rules in the access control file are applied according to the following principles:
Any operation not explicitly authorized through an authorization rule is implicitly prohibited. For example, if the access control file contains no authorization rules, all users are denied access to all operations.
Authorization rules for specific users override those applying generically to all users. For example, the rules
queue.q1.produce.allow.user=* queue.q1.produce.deny.user=Snoopy
authorize all users except Snoopy to send messages to queue destination q1.
Authorization rules for a specific user override those for any group to which the user belongs. For example, if user Snoopy is a member of group user, the rules
queue.q1.consume.allow.group=user queue.q1.consume.deny.user=Snoopy
authorize all members of user except Snoopy to receive messages from queue destination q1.
Authorization rules applying generically to all users override those applying to all groups. For example, the rules
topic.t1.produce.deny.group=* topic.t1.produce.allow.user=*
authorize all users to publish messages to topic destination t1, overriding the rule denying such access to all groups.
Authorization rules for specific resources override those applying generically to all resources of a given type. For example, the rules
topic.*.consume.allow.user=Snoopy topic.t1.consume.deny.user=Snoopy
authorize Snoopy to subscribe to all topic destinations except t1.
Authorization rules authorizing and denying access to the same resource and operation for the same user or group cancel each other out, resulting in authorization being denied. For example, the rules
queue.q1.browse.deny.user=Snoopy queue.q1.browse.allow.user=Snoopy
prevent Snoopy from browsing queue q1. The rules
topic.t1.consume.deny.group=user topic.t1.consume.allow.group=user
prevent all members of group user from subscribing to topic t1.
When multiple authorization rules are specified for the same resource, operation, and principal type, only the last rule applies. The rules
queue.q1.browse.allow.user=Snoopy,Linus queue.q1.browse.allow.user=Snoopy
authorize user Snoopy, but not Linus, to browse queue destination q1.
Authorization rules with the resource type connection control access to the broker's connection services. The rule's resourceVariant element specifies the service type of the connection services to which the rule applies, as shown in Table 6–1; the only possible values are NORMAL or ADMIN. There is no operation element.
The default access control file contains the rules
connection.NORMAL.allow.user=* connection.ADMIN.allow.group=admin
giving all users access to NORMAL connection services (jms, ssljms, httpjms, and httpsjms) and those in the admin group access to ADMIN connection services (admin and ssladmin). You can then add additional authorization rules to restrict the connection access privileges of specific users: for example, the rule
denies user Snoopy access privileges for connection services of type NORMAL.
If you are using a file-based user repository, the admin user group is created by the User Manager utility. If access control is disabled (imq.accesscontrol.enabled = false), all users in the admin group automatically have connection privileges for ADMIN connection services. If access control is enabled, access to these services is controlled by the authorization rules in the access control file.
If you are using an LDAP user repository, you must define your own user groups in the LDAP directory, using the tools provided by your LDAP vendor. You can either define a group named admin, which will then be governed by the default authorization rule shown above, or edit the access control file to refer to one or more other groups that you have defined in the LDAP directory. You must also explicitly enable access control by setting the broker's imq.accesscontrol.enabled property to true.
Access to specific physical destinations on the broker is controlled by authorization rules with a resource type of queue or topic, as the case may be. These rules regulate access to the following operations:
Sending messages to a queue: produce operation
Receiving messages from a queue: consume operation
Publishing messages to a topic: produce operation
Subscribing to and consuming messages from a topic: consume operation
Browsing a queue: browse operation
By default, all users and groups are authorized to perform all of these operations on any physical destination. You can change this by editing the default authorization rules in the access control properties file or overriding them with more specific rules of your own. For example, the rule
denies all members of the user group the ability to subscribe to the topic Admissions.
When a client creates a message producer or consumer for a physical destination that does not already exist, the broker will auto-create the destination (provided that the broker's imq.autocreate.queue or imq.autocreate.topic property is set to true).
The final section of the access control file controls the ability of users and groups to auto-create destinations, and to access any auto-created destinations. This is governed by authorization rules with a resourceType of queue or topic and an operation element of create. the resourceVariant element is omitted, since these rules apply to all auto-created queues or all auto-created topics, rather than any specific destination.
The default access control file contains the rules
queue.create.allow.user=* topic.create.allow.user=*
authorizing all users to have physical destinations auto-created for them by the broker, and to have access to any auto-created destinations. You can edit the file to restrict such authorization for specific users. For example, the rule
denies user Snoopy the ability to auto-create topic destinations or to access any auto-created topic destinations.
The effect of such auto-creation rules must be congruent with that of other physical destination access rules. For example, if you change the destination authorization rule to prohibit any user from sending a message to a queue, but enable the auto-creation of queue destinations, the broker will create the physical destination if it does not exist, but will not deliver a message to it.
This section explains how to set up a connection service based on the Secure Socket Layer (SSL) standard, which enables delivery of encrypted messages over the connection. Message Queue supports the following SSL-based connection services:
The ssljms service delivers secure, encrypted messages between a client and a broker, using the TCP/IP transport protocol.
The httpsjms service delivers secure, encrypted messages between a client and a broker, using an HTTPS tunnel servlet with the HTTP transport protocol.
The ssladmin service creates a secure, encrypted connection between the Message Queue Command utility (imqcmd) and a broker, using the TCP/IP transport protocol. Encrypted connections are not supported for the Administration Console (imqadmin).
The cluster connection service is used internally to provide secure, encrypted communication between brokers in a cluster, using the TCP/IP transport protocol.
A JMX connector that supports secure, encrypted communication between a JMX client and a broker's MBean server using the RMI transport protocol over TCP.
The remainder of this section describes how to set up secure connections over TCP/IP, using the ssljms, ssladmin, and cluster connection services. For information on setting up secure connections over HTTP with the httpsjms service, see Appendix C, HTTP/HTTPS Support.
To use an SSL-based connection service over TCP/IP, you generate a public/private key pair using the Key Tool utility (imqkeytool). This utility embeds the public key in a self-signed certificate that is passed to any client requesting a connection to the broker, and the client uses the certificate to set up an encrypted connection. This section describes how to set up an SSL-based service using such self-signed certificates.
For a stronger level of authentication, you can use signed certificates verified by a certification authority. The use of signed certificates involves some additional steps beyond those needed for self-signed certificates: you must first perform the procedures described in this section and then perform the additional steps in Using Signed Certificates.
Message Queue's support for SSL with self-signed certificates is oriented toward securing on-the-wire data, on the assumption that the client is communicating with a known and trusted server. Configuring SSL with self-signed certificates requires configuration on both the broker and client:
Setting Up an SSL-Based Connection Service Using Self-Signed Certificates
Configuring and Running an SSL-Based Client Using Self-Signed Certificates
The following sequence of procedures are needed to set up an SSL-based connection service for using self-signed certificates:
Starting with release 4.0, the default value for the client connection factory property imqSSLIsHostTrusted is false. If your application depends on the prior default value of true, you need to reconfigure and to set the property explicitly to true. In particular, old or new clients using self-signed certificates should set this property to true; for example:java -DimqConnectionType=TLS -DimqSSLIsHostTrusted=true MyApp
The administration tool imqcmd is also affected by this change. In addition to using the –secure option to specify that it uses a SSL-based admin connection service, the imqSSLIsHostTrusted should be set to true when connecting to a broker configured with a self-signed certificate. You can do this as follows:imqcmd list svc -secure -DimqSSLIsHostTrusted=true
Alternatively, you can import the broker's self-signed certificate into the client runtime trust store. Use the procedure in To Install a Signed Certificate.
Generate a self-signed certificate.
Enable the desired SSL-based connection services in the broker. These can include the ssljms, ssladmin, or cluster connection services.
Start the broker.
Run the Key Tool utility (imqkeytool) to generate a self-signed certificate for the broker. (On Solaris and Linux operating systems, you may need to run the utility as the root user in order to have permission to create the keystore file.) The same certificate can be used for all SSL-based connection services (ssljms, ssladmin, cluster connection services, and the ssljmxrmi connector).
Enter the following at the command prompt:
imqkeytool -broker
The Key Tool utility prompts you for a key store password:
At the prompt type a keystore password.
The Keystore utility prompts you for identifying information from which to construct an X.500 distinguished name. The following table shows the prompts and the values to be provided for each. Values are case-insensitive and can include spaces.
X.500 Attribute
What is your first and last name?
commonName (CN)
Fully qualified name of server running the broker
What is the name of your organizational unit?
organizationalUnit (OU)
Name of department or division
What is the name of your organization?
organizationName (ON)
Name of larger organization, such as a company or government entity
Acme Widgets, Inc.
What is the name of your city or locality?
localityName (L)
Name of city or locality
San Francisco
What is the name of your state or province?
stateName (ST)
Full (unabbreviated) name of state or province
What is the two-letter country code for this unit?
country (C)
Standard two-letter country code
The Key Tool utility displays the information you entered for confirmation. For example,
Is CN=mqserver.sun.com, OU=purchasing, ON=Acme Widgets, Inc., L=San Francisco, ST=California, C=US correct?
Accept the current values and proceed by typing yes.
To reenter values, accept the default or enter no. After you confirm, the utility pauses while it generates a key pair.
The utility asks for a password to lock the key pair (key password).
Press return.
This will set the same password for both the key password and the keystore password.
Be sure to remember the password you specify. You must provide this password when you start the broker, to allow the broker to open the keystore file. You can store the keystore password in a password file (see Password Files).
The Key Tool utility generates a self-signed certificate and places it in Message Queue's keystore file. The keystore file is located in a directory whose location depends upon the operating system platform, as shown in Appendix A, Distribution-Specific Locations of Message Queue Data.
The following are the configurable properties for the Message Queue keystore for SSL-based connection services:
Path to directory containing keystore file (see Appendix A, Distribution-Specific Locations of Message Queue Data for default value)
In some circumstances, you may need to regenerate a key pair in order to solve certain problems: for example, if you forget the key store password or if the SSL-based service fails to initialize when you start a broker and you get the exception:
java.security.UnrecoverableKeyException: Cannot recover key
(This exception may result if you provided a key password different from the keystore password when you generated the self-signed certificate.)
Remove the broker's keystore file.
The file is located as shown in Appendix A, Distribution-Specific Locations of Message Queue Data.
Run imqkeytool again.
The command will generate a new key pair, as described above.
To enable an SSL-based connection service in the broker, you need to add the corresponding service or services to the imq.service.activelist property.
Open the broker's instance configuration file.
The instance configuration file is located in a directory identified by the name of the broker instance (instanceName) with which the configuration file is associated (see Appendix A, Distribution-Specific Locations of Message Queue Data):
Add an entry (if one does not already exist) for the imq.service.activelist property and include the desired SSL-based service(s) in the list.
By default, the property includes the jms and admin connection services. Add the SSL-based service or services you wish to activate (ssljms, ssladmin, or both):
The SSL-based cluster connection service is enabled using the imq.cluster.transport property rather than the imq.service.activelist property (see Cluster Connection Service Properties). To enable SSL for RMI-based JMX connectors, see SSL-Based JMX Connections.
Save and close the instance configuration file.
Start the broker, providing the key store password.
When you start a broker or client with SSL, you may notice a sharp increase in CPU usage for a few seconds. This is because the JSSE (Java Secure Socket Extension) method java.security.SecureRandom, which Message Queue uses to generate random numbers, takes a significant amount of time to create the initial random number seed. Once the seed is created, the CPU usage level will drop to normal.
Start the broker, providing the keystore password.
Put the keystore password in a password file, as described in Password Files and set the imq.passfile.enabled property to true. You can now do one of the following:
Pass the location of the password file to the imqbrokerd command:
imqbrokerd -passfile /passfileDirectory/passfileName
Start the broker without the -passfile option, but specify the location of the password file using the following two broker configuration properties:
If you are not using a password file, enter the keystore password at the prompt.
You are prompted for the keystore passwrd.
The procedure for configuring a client to use an SSL-based connection service differs depending on whether it is an application client (using the ssljms connection service) or a Message Queue administrative client such as imqcmd (using the ssladmin connection service.)
For application clients, you must make sure the client has the following .jar files specified in its CLASSPATH variable:
Once the CLASSPATH files are properly specified, one way to start the client and connect to the broker's ssljms connection service is by entering a command like the following:
java -DimqConnectionType=TLS clientAppName
This tells the connection to use an SSL-based connection service.
For administrative clients, you can establish a secure connection by including the -secure option when you invoke the imqcmd command: for example,
imqcmd list svc -b hostName:portNumber -u userName -secure
where userName is a valid ADMIN entry in the Message Queue user repository. The command will prompt you for the password.
Listing the connection services is a way to verify that the ssladmin service is running and that you can successfully make a secure administrative connection, as shown in Example 9–6.
Signed certificates provide a stronger level of server authentication than self-signed certificates. You can implement signed certificates only between a client and broker, and currently not between multiple brokers in a cluster. This requires the following extra procedures in addition to the ones described in Using Self-Signed Certificates. Using signed certificates requires configuration on both the broker and client:
The following procedures explain how to obtain and install a signed certificate.
Use the J2SE keytool command to generate a certificate signing request (CSR) for the self-signed certificate you generated in the preceding section.
Information about the keytool command can be found at
Here is an example:
keytool -certreq -keyalg RSA -alias imq -file certreq.csr -keystore /etc/imq/keystore -storepass myStorePassword
This generates a CSR encapsulating the certificate in the specified file (certreq.csr in the example).
Use the CSR to generate or request a signed certificate.
You can do this by either of the following methods:
Have the certificate signed by a well known certification authority (CA), such as Thawte or Verisign. See your CA's documentation for more information on how to do this.
Sign the certificate yourself, using an SSL signing software package.
The resulting signed certificate is a sequence of ASCII characters. If you receive the signed certificate from a CA, it may arrive as an e-mail attachment or in the text of a message.
Save the signed certificate in a file.
The instructions below use the example name broker.cer to represent the broker certificate.
Check whether J2SE supports your certification authority by default.
The following command lists the root CAs in the system key store:
keytool -v -list -keystore $JAVA_HOME/lib/security/cacerts
If your CA is listed, skip the next step.
If your certification authority is not supported in J2SE, import the CA's root certificate into the Message Queue key store.
Here is an example:
keytool -import -alias ca -file ca.cer -noprompt -trustcacerts -keystore /etc/imq/keystore -storepass myStorePassword
where ca.cer is the file containing the root certificate obtained from the CA.
If you are using a CA test certificate, you probably need to import the test CA root certificate. Your CA should have instructions on how to obtain a copy.
Import the signed certificate into the key store to replace the original self-signed certificate.
Here is an example:
keytool -import -alias imq -file broker.cer -noprompt -trustcacerts -keystore /etc/imq/keystore -storepass myStorePassword
where broker.cer is the file containing the signed certificate that you received from the CA.
The Message Queue key store now contains a signed certificate to use for SSL connections.
You must now configure the Message Queue client runtime to require signed certificates, and ensure that it trusts the certification authority that signed the certificate.
By default, starting with release 4.0, the connection factory object that the client will be using to establish broker connections has its imqSSLIsHostTrusted attribute set to false, meaning that the client runtime will attempt to validate all certificates. Validation will fail if the signer of the certificate is not in the client's trust store.
Verify whether the signing authority is registered in the client's trust store.
To test whether the client will accept certificates signed by your certification authority, try to establish an SSL connection, as described above under Configuring and Running an SSL-Based Client Using Self-Signed Certificates. If the CA is in the client's trust store, the connection will succeed and you can skip the next step. If the connection fails with a certificate validation error, go on to the next step.
Install the signing CA's root certificate in the client's trust store.
The client searches the key store files cacerts and jssecacerts by default, so no further configuration is necessary if you install the certificate in either of those files. The following example installs a test root certificate from the Verisign certification authority from a file named testrootca.cer into the default system certificate file, cacerts. The example assumes that J2SE is installed in the directory $JAVA_HOME/usr/j2se:
keytool -import -keystore /usr/j2se/jre/lib/security/cacerts -alias VerisignTestCA -file testrootca.cer -noprompt -trustcacerts -storepass myStorePassword
An alternative (and recommended) option is to install the root certificate into the alternative system certificate file, jssecacerts:
keytool -import -keystore /usr/j2se/jre/lib/security/jssecacerts -alias VerisignTestCA -file testrootca.cer -noprompt -trustcacerts -storepass myStorePassword
A third possibility is to install the root certificate into some other key store file and configure the client to use that as its trust store. The following example installs into the file /home/smith/.keystore:
keytool -import -keystore /home/smith/.keystore -alias VerisignTestCA -file testrootca.cer -noprompt -trustcacerts -storepass myStorePassword
Since the client does not search this key store by default, you must explicitly provide its location to the client to use as a trust store. You do this by setting the Java system property javax.net.ssl.trustStore once the client is running:
Several types of command require passwords. In Table 9–6, the first column lists the commands that require passwords and the second column lists the reason that passwords are needed.Table 9–6 Commands That Use Passwords
Purpose of Password
Start broker
Access a JDBC-based persistent data store, an SSL certificate key store, or an LDAP user repository
Manage broker
Authenticate an administrative user who is authorized to use the command
Manage JDBC-based data store
Access the data store
You can specify these passwords in a password file and use the -passfile option to specify the name of the file. This is the format for the -passfile option:
imqbrokerd -passfile filePath
In previous versions of Message Queue, you could use the -p, -password, -dbpassword, and -ldappassword options to specify passwords on the command line. As of Message Queue 4.0, these options are deprecated and are no longer supported; you must use a password file instead.
Typing a password interactively, in response to a prompt, is the most secure method of specifying a password (provided that your monitor is not visible to other people). You can also specify a password file on the command line. For non-interactive use of commands, however, you must use a password file.
A password file is unencrypted, so you must set its permissions to protect it from unauthorized access. Set the permissions so that they limit the users who can view the file, but provide read access to the user who starts the broker.
A password file is a simple text file containing a set of properties and values. Each value is a password used by a command. Table 9–7 shows the types of passwords that a password file can contain.Table 9–7 Passwords in a Password File
Affected Commands
Administrator password for Message Queue Command utility (authenticated for each command)
Key store password for SSL-based services
Password for opening a database connection, if required
Password associated with the distinguished name assigned to a broker for binding to a configured LDAP user repository
A sample password file is provided as part of your Message Queue installation; see Appendix A, Distribution-Specific Locations of Message Queue Data for the location of this file, depending on your platform.
When a client application is separated from the broker by a firewall, special measures are needed in order to establish a connection. One approach is to use the httpjms or httpsjms connection service, which can "tunnel" through the firewall; see Appendix C, HTTP/HTTPS Support for details. HTTP connections are slower than other connection services, however; a faster alternative is to bypass the Message Queue Port Mapper and explicitly assign a static port address to the desired connection service, and then open that specific port in the firewall. This approach can be used to connect through a firewall using the jms or ssljms connection service (or, in unusual cases, admin or ssladmin).Table 9–8 Broker Configuration Properties for Static Port Addresses
Connection Service
Configuration Property
Assign a static port address to the connection service you wish to use.
To bypass the Port Mapper and assign a static port number directly to a connection service, set the broker configuration property imq.serviceName.protocolType.port, where serviceName is the name of the connection service and protocolType is its protocol type (see Table 9–8). As with all broker configuration properties, you can specify this property either in the broker's instance configuration file or from the command line when starting the broker. For example, to assign port number 10234 to the jms connection service, either include the line
in the configuration file or start the broker with the command
imqbrokerd -name brokerName -Dimq.jms.tcp.port=10234
where brokerName is the name of the broker to be started.
Configure the firewall to allow connections to the port number you assigned to the connection service.
You must also allow connections through the firewall to Message Queue's Port Mapper port (normally 7676, unless you have reassigned it to some other port). In the example above, for instance, you would need to open the firewall for ports 10234 and 7676.
Message Queue supports audit logging. When audit logging is enabled, Message Queue generates a record for the following types of events:
Startup, shutdown, restart, and removal of a broker instance
User authentication and authorization
Reset of a persistent store
Creation, purge, and destruction of a physical destination
Administrative destruction of a durable subscriber
Message Queue supports logging audit records to the Message Queuebroker log file and to the Solaris BSM audit log:
To log audit records to the Message Queue broker log file, set the imq.audit.enabled broker property to true . All audit records in the broker log contain the keyword AUDIT.
To log audit records to the Solaris BSM audit log, set the imq.audit.bsm.disabled broker property to false .
To log audit records to the Solaris BSM audit log, you must run the broker as root, and /usr/lib/audit/Audit.jar must be in the broker classpath.


text:
de Buyer Mineral "B" Fry Pan
With its classic French shape, this fry pan excels for searing, browning and grilling as well as cooking omelettes and sautéing vegetables. Made of 99% iron with no chemicals or coatings added, this pan has an organic beeswax finish for a naturally stick-resistant surface.
- Made of 99% iron, a natural mineral material.
- Organic beeswax finish—denoted by a "B" in the pan's center—protects pan against oxidation, helps in the seasoning process and improves nonstick quality.
- With use, the pan darkens and develops a naturally nonstick surface, and the "B" in the center will disappear.
- Allows high-heat searing to seal in food flavors, juices and nutrients.
- Safe for use on all heat sources including induction.
- Triple-riveted steel handle.
- Made in France.
Dimensions & More Info
- 10" fry pan: 10"diam.; 4 lb.
- 12" fry pan: 12"diam.; 5 lb. 12 oz.
- Made in France.
Use & Care
- Ideal for use on any type of cooktop, including induction.
- Oven and broiler safe.
- Hand wash only. Use hot water, and just a few drops of gentle soap if necessary. Do not soak pan.
- Remove any residue with a nonabrasive scouring pad.
- After washing, dry pan and lightly season: Add a few drops of cooking oil to pan and wipe with a paper towel, leaving a thin layer of oil on pan before storing.
- Season pan before first use: Place potato peelings in the pan with about 1 cup of water. Bring to a boil for 15 minutes. Drain the mixture, then rinse the pan. Cover the pan bottom with a coating of frying oil and dry it for a few minutes. Discard oil and wipe the pan with a paper towel.
More about de Buyer
The de Buyer family has been making cookware in the French town of Val-d'Ajol since 1830. The family-owned company originally crafted pots and cauldrons for cooking over a live fire using iron ore extracted from the region. Pairing modern technology with a timeless attention to quality, De Buyer still creates cookware in the classic French shapes and materials traditionally used in professional kitchens. In addition to copper and iron collections, the company also offers stainless-steel and nonstick lines to meet the needs of today's home cooks.
Price Match Guarantee
Williams Sonoma Price Match Guarantee
At Williams Sonoma, we're committed to bringing you the best quality at the best prices.
If you find a lower price on any of our products, we'll match it—guaranteed. Click here for details.
Shipping Information
UPS can deliver most in-stock items within 3–5 business days. UPS is unable to deliver to P.O. boxes.
Shipping Rates
The shipping rate varies depending on your order total and shipping destination. View Shipping Options and Charges.
Next Day Delivery
For an additional charge of $26 per address, we can expedite delivery to most destinations. This service is not available for some oversize items, items shipped directly from the supplier (including perishable and custom-manufactured items), out-of-stock items and items to be shipped outside the contiguous 48 states.
Orders received by 9:00 p.m. ET Monday through Thursday will arrive the next business day; orders placed Friday through Sunday will arrive on the following Tuesday.
Return Policy
At Williams Sonoma, we take great pride in the quality and craftsmanship of our products. Attention to design, materials, safety and construction are our priority. Upon receipt, please inspect your purchase and notify us of any damage; we will arrange for a prompt replacement.
If within 30 days, you are dissatisfied for any reason, you may return your purchase for a refund of the merchandise value. An original receipt or gift receipt is required for all returns and exchanges. Returns with a gift receipt will be refunded in the form of a Merchandise Credit for the amount indicated on the gift receipt. Returns with original receipt will be refunded in the original form of payment, cash and check refunds over $100 will be issued as a company check (may take 14 business days from time of request).
For all cutlery returns (knife sets, single knives, cutting boards, knife sharpeners and knife storage), please contact us at 888.922.4108 to initiate the return.
We cannot accept returns on monogrammed, personalized, special-order items, custom upholstery, food, items shipped direct from the vendor or on items damaged through normal wear and tear. Final sale items ending in .97 or .99 cannot be returned.
Made to Order and Final Sale Furniture items are non-returnable and cannot be cancelled once the order is placed.
For returns of items purchased from your Williams Sonoma Gift Registry, we will gladly provide a refund or exchange for the merchandise within 90 days of your event or within 90 days of purchase, whichever date is later. View Full Returns Policy.
de Buyer Mineral "B" Fry Pan
|Delivery Surcharge
|de Buyer Mineral "B" Fry Pan, 10"
|Sugg. Price $59.95 Our Price $47.96
|de Buyer Mineral "B" Fry Pan, 12
|Sugg. Price $79.95 Our Price $63.96


text:
Trying to narrow down which electronic cigarette is right for you can be a daunting job. It's a big decision to switch from conventional cigarettes that you know and love to a new technology where there is no smoke but instead warm nicotine water vapor and liquid nicotine. After trying and reviewing dozens of vaping options. We've taken in all the information and crystallized it into a few important points that will let you make an informed decision you will be comfortable with.
But before we get into the details on ecigs, if you are considering straight vaping instead of traditional cigalike try these liquids: http://www.freshvaping.com/
Here are the big variables we reviewed for you:
- Presentation and packaging of the starter kit
- Flavor Score: is it bold, light, intense or mild
- Flavor variety
- Vapor Volume
- Battery life
- Value
- Shipping
We then take all these variables and arrive at an overall star rating for the brand that gives you an at-a-glance overview of how we feel about this particular e- cig.
There are other considerations you should think about:
- Which brand are people happiest with?
- Which brand produces the most vapor?
- Which vapor cartridges are the best value? You'll most likely be spending a lot on this, so this is very important.
- If I pay more for a ecig starter kit what does that get me?
- Will these vaping cartridges come close to the flavor I love in my traditional cigarette?
- If you would like to smoke a menthol electronic cigarette, how true to form is each ecig brand traditional menthol cigarettes like: Kool, Newport, and Marlboro?
The spectrum of flavors available to you as an e-smoker are so much broader than what you may be accustomed to smoking tobacco cigarettes. There flavors range from sweet flavors such as cherry, chocolate and vanilla, to bolder flavors like coffee and clove. So make sure the company you ultimately choose has the a good depth of flavors as it may be important to you down the road.
Is the company American or foreign-owned? how will that impact your decision.
Lastly take some time to browse the site and read other e-smoker reviews and learn what they like and dislike about vaping. We encourage to leave a review when you are done so other can learn from your experience. Good luck on your journey to vaping!


text:
Schedule a Room
Study Rooms
Six study rooms are available on the second floor of the library and four study rooms are available on the third floor.
Study rooms can be reserved on the second floor at the Course Reserves counter.
- Online: Click a date/time on the calendar
- Call: 315-498-2327
- In-Person: Visit the Course Reserves counter
Study Room Policy
- A college ID is required.
- Reservations can be made up to 2 weeks in advance. No semester bookings.
- An individual may only reserve up to 2 hours of time per day.
- --This includes both walk-ins and advance reservations.
- Second floor study rooms will close 15 minutes prior to library closing.
- Third floor study rooms will close at 6PM.
- After a 15 minute grace period, reservations will be cancelled.
- Rooms are for groups of 1 - 6 people.
- Study rooms are for academic use only.
- Walk-ins are welcome providing rooms are available.
- Before leaving users of the room are responsible for cleanup.
- The study room windows must not be blocked or covered at any time.
- A replacement fee of $195.00 will be billed to the student for any keys that are not returned.
We reserve the right to ask anyone to leave the room for any reason.


text:
ABC's longest-running primetime entertainment show, America's Funniest Home Videos, returns for season 26 this fall with the same mission -- giving families something genuinely funny to enjoy together on Sunday nights. Along with a new host, the upcoming season will welcome an abundant supply of fresh clips to keep families laughing from coast to coast.
"AFV," the longest-running primetime entertainment show in ABC history, returns for season 27 with the same mission - to provide viewers with hysterical moments that fly by at a dizzying pace.


text:
Bill Moore, a former marketing executive with Ace Hardware Corporation, has joined Mr. Electric, the world's largest electrical service and repair franchise, as a California-based regional manager for the rapidly growing franchise network. For the past six years, Moore managed national marketing, advertising, corporate communications and public relations functions for the Fortune 500 company and its 5,000 independently owned locations.
In his new role for Mr. Electric, Moore will borrow from his extensive background of counseling small-business owners in all aspects of business operations to assist the franchise in its next phase of national growth. He brings to Mr. Electric more than 28 years of experience in financial planning, successful retail practices, advertising and marketing, competitive positioning and strategies for profitable growth.
"Bill's expertise is unsurpassed," said Tom Buckley, president of Mr. Electric. "He joins our company at the perfect time as we seek to support our franchise owners at the grassroots level and continue to build our rapidly-growing network."
Attention CEE News readers: Do you have a news item for Electric Avenue? E-mail it to Mike Harrington at [email protected].


text:
LEARN-TO-skate registration for BASIC 3
Basic 3 Sessions take place on Tuesdays or Thursdays from 3:30pm-4:00pm.
If this is the skaters First 6 week session of the season (Season is defined as July 1-June 30), please fill out the Learn to Skate USA Membership Form online HERE and include the once yearly fee of $16. After paying for your membership, you will be given a Membership ID#, please keep this number as you will need to enter it in the following Learn-to-Skate Registration form.
To pre-pay for your Skate Rentals for the session you are registering for, be sure to add it to your cart before you proceed to checkout.


text:
Joe Morin on Danny's DepartureBlog Post: August 29, 2006
I cant believe that the sale to incisive wouldn't have included a non compete clause. Unless the board at incisive were out to lunch when they put the deal together, they surely recognised the pivotal role played by Danny, and would have put in some sort of post earn out clause to prevent him simply doing it all again head to head from the power position of his current status. No disrespect to danny. The guy rocks, and he's been the beacon for the search industry for years... but in all the deals I've seen, even where the acquirer didn't rate the management team there was a non compete clause.


text:
Professor Lawrence Lessig Gives Talk for Center for EthicsDr. Lawrence Lessig, director of the Edmond J. Safra Foundation Center for Ethics at Harvard University and the Roy L. Furman Professor of Law and Leadership at Harvard Law School, will deliver a talk.
Wednesday, April 10, 2013 09:58 AM
The talk, "What Does It Mean to Say, 'Our Congress is Corrupt'?," on Monday, April 15, at 7:30 p.m. in the Empie Theatre, Center for the Arts. This event, the final in the year-long Center for Ethics series Market\Values, is free and open to the public.
Before rejoining the faculty at Harvard University, Lessig taught at Stanford University, where he founded the Center for Internet and Society, and at the University of Chicago. His research has focused on law and technology, especially as it affects copyright. Currently, his work focuses on issues of institutional corruption as it affects public trust. Lessig is the author of five books: Code and Other Laws of Cyberspace (1999), The Future of Ideas (2001), Free Culture (2004), Code Version 2.0 (2007) and Remix (2008) and hundreds of articles, columns and commentaries. Lessig has won many awards, including the Free Software Foundation's Freedom Award and the Fastcase 50 Award. He was also named one of Scientific American's Top 50 Visionaries.
Market\Values is co-directed by Sue Curry Jansen, professor of media and communications, Mohsin Hashim, associate professor of political science, and Marcia Morgan, assistant professor of philosophy. This year-long program examines historical and contemporary questions about markets and accompanying moral issues they raise. The goal of the Center for Ethics' programming is to engage the community in intensive and reflective thinking about individual and collective values.
For more information on the series, please visit http://www.muhlenberg.edu/main/aboutus/cfe/.


text:
North Charleston's population could soon grow by several thousand as a plan to extend the city's reach into Dorchester County and encourage residential development there bears out.
Like many stories of development, this one began with a road.
In 2005 the city and Centex Homes agreed to work together to extend Patriot Boulevard all the way to Palmetto Commerce Parkway. The city, Centex and Dorchester County all chipped in for the road, which used to end at Wescott Boulevard.
In the same agreement, North Charleston agreed to annex hundreds of acres that the extension of Patriot Boulevard would bisect in Dorchester County, and allow up to 2,400 new homes there.
The housing market meltdown began a few years later and stalled those planned homes, but roofs are rising today at a brisk pace.
"It's growing now," said North Charleston Mayor Keith Summey. "We're getting a lot of new houses back there."
The Patriot Boulevard extension created a direct connection from Palmetto Commerce Parkway, and all the new industry there, to Ashley Phosphate Road. Boeing Corp's aircraft interiors plant and Daimler's Sprinter van assembly factory are both at the intersection of Patriot Boulevard and Palmetto Commerce Parkway.
Nearby, the Dorchester 2 School District built Joseph R. Pye Elementary School on the newer section Patriot Boulevard, at a cost of about $15 million. The school, which opened in August 2001, sits on 25 acres of land acquired from Centex.
Now, with the housing market in recovery, 1,290 new homes and 320 apartments are planned along the road. The land has been divided and is being developed by multiple companies including Centex, Lennar, and HH Hunt.
"There's growth all over the city, but it's certainly concentrated in that area," said Gwen Moultrie, director of the North Charleston Planning and Zoning Department.
About 200 homes have been built so far, all of them in McKewn by Centex, on the north side of Patriot Boulevard. North Charleston says 732 homes are planned on that side of Patriot Boulevard.
Across the street, HH Hunt's 320-unit Abberly Crossing apartment complex is well under construction, and on the largest undeveloped piece of the development site Lennar is finalizing plans to build 558 homes in a development called Coosaw Preserve.
"We're turning the engineers loose to start designing the boulevard," said Frank Finlaw, director of land for Lennar, referring to the main road through Coosaw Preserve. "We hope to be putting shovels in the ground late this year or early next year."
Add up the development plans and there could be 1,610 new houses, townhomes and apartments under way. That's well below the 2,400 homes allowed by the development agreement, but enough to add several thousand people to North Charleston's population of about 102,000 and fill many seats at Pye Elementary.
"The world has changed drastically in our business since the time of the development (agreement)," said Finlaw. "There were some things we changed, and things we have frankly upgraded."
"We don't have any multi-family in there, the lots are deeper than they might have been, and we are creating neighborhoods," he said.
Finlaw said having larger lots than originally planned will also create more distance between the new homes and those in existing neighborhoods. The site abuts Coosaw Creek to the south, and the Parkwood and Wheatstone sections of the Farms at Wescott to the west.
"This was planned, and it's good to see it going again," said Moultrie. "It's great for the economy."
Reach David Slade at 937-5552 or Twitter @DSladeNews.


text:
Christmas/New Year Paper Kit Freebie
Happy New Year! I pray that every one of you has the best year ever and that you grow closer to our God. Here is an article I came across that says something important I have talked to you about before. I hope it blesses you as we strive to be more pleasing to Him this coming year.
Bossing God Around by Mark O. Wilson
A nine year old boy was given a full grown St. Bernard for Christmas. Viewing his present with extreme delight and wonder, he exclaimed, "Wow!!! That's great!!! But is he mine – or am I his?"
Now, that's a great question for every Christian: Is Jesus mine – or am I His?
The answer ought to be "Yes!"
It is certainly a wonderful fact that Christ is a friend like no other. He meets our needs. He satisfies our deepest longings. He is a present help in the hour of trouble. He is the one who steps in when the rest of the world steps out.
Blessed assurance, Jesus is mine! He is my Savior, my Deliverer, my Joy, and my Strength!
We must never forget, however, who we are and who God is. We don't "own" Him.
George Barna, conducting recent research of American evangelical churches concluded that there is a deep-rooted self centeredness at the core of our religious expressions. A "consumer mind set" prevails across the board – "I'm involved with church for what I get out of it." What's in it for me? No wonder religion seems so empty.
I've had well meaning friends tell me how they boss God around when they pray: "God, I need this and that. You really have to come through for me here. I'm counting on you and you had better not let me down!"
There's something wrong with this picture.
We need God – but He doesn't need us. He is willing to help and strengthen us – but we don't have the right to give him orders. (end of quote)
And I'd personally add, people loudly and boldly thanking God for things they never asked Him for but think that thanking Him for it obligates Him, by virtue of our faith, to do/give what we say. We will never be God's boss, not even by faith. True, without faith we won't get anything, but having it doesn't make Him have to do anything outside of His will. Remember, our Lord Jesus taught us to pray, "As You will, not as I will", and He was the Son of God!
Today's gift for you is this gorgeous kit of Papers for Christmas and New Years - enjoy!
If you like it well enough to download, please leave me a comment at the bottom of this post as I have disabled 4shared comments. Please support this blog by shopping my PayPal store. God bless you!Download here for 24 hours, then available in my store. If you can't find it, e-mail me. Check out my TERMS OF USE here.The password is jesuschristislord.Digifree CraftCrave CraftCrave