Subscription Security

Subscription security is the operational and access-control discipline around DEFINE SUB objects, dynamic MQI and JMS subscriptions, and the destination queues that receive publication copies. Topic SUB authority decides who may register interest; subscription security goes further—which DEST names are allowed, whether durable subs survive credential rotation, who may DISPLAY or DELETE subscriptions, and how you detect a shadow subscription copying hr/salary/# to an unapproved queue. Incidents in mature estates often start with an old test subscription left on a production queue manager, not with broken TLS. This tutorial covers administrative versus application-created subs, DEST queue hardening, SUBUSER considerations, managed queue authority after auto-create, cluster SUBSCOPE exposure, audit runbooks, and pairing subscription reviews with topic ACL exports.

Threat Model: What Can Go Wrong

An identity with +sub on a broad pattern and +get on a queue they control receives every matching publication automatically—no need to hack the publisher. A developer who keeps DURSUB(YES) on a test TOPICSTR pointing at prod-like patterns after go-live continues receiving regulated data. Multiple applications sharing one DEST without coordination leak messages between teams. Cluster SUBSCOPE(ALL) multiplies interest across sites—attack surface grows with repository visibility.

Subscription security controls
ControlProtects againstImplementation
Narrow +subUnauthorized interest registrationTopic ACL at entity branch not prod/#
Approved DEST listCopy to rogue queueQueue OAM only on named QLOCAL prefixes
Admin-only DEFINE SUBMQSC subscription sprawlRestrict crt on SUB objects if supported
DISPLAY SUB auditsShadow and stale subsWeekly automation compare to CMDB
Separate service IDsShared credential abuseOne MCAUSER per consumer app

Securing Administrative DEFINE SUB

shell
1
2
3
4
5
6
7
* Approved pattern - operations pipeline only DEFINE SUB('FIN.REPORTING.SUB') TOPICSTR('prod/finance/report/#') + DESTQL('FIN.REPORTING.Q') DESTTYPE(UNMANAGED) DURSUB(YES) + SUBSCOPE(QMGR) DESCR('Approved reporting consumer') setmqaut -m QM1 -t topic -n 'prod/finance/report/#' -p MQ.REPORT +sub setmqaut -m QM1 -n FIN.REPORTING.Q -p MQ.REPORT +get +dsp * Developers lack +sub on prod/finance/report/#

Store DEFINE SUB in Git; peer review TOPICSTR and DESTQL like application code. DELETE SUB in decommission runbooks before removing applications. REPLACE on redeploy should not accidentally widen TOPICSTR to # without architecture approval.

Dynamic and JMS Subscriptions

Runtime-created subs inherit the connection identity. Lock down SVRCONN MCAUSER mapping so microservices cannot connect as a shared power user with wide SUB. JMS durable subscriber client ID and subscription name conventions help audits—document expected DISPLAY SUB rows per deploy. After penetration tests, scan for subs pointing to unexpected DESTQL names containing EXFIL, TEMP, or personal user IDs.

Destination Queue Hardening

  • Prefix subscriber queues: APPNAME.EVENTS.SUB for easy OAM profiles.
  • Deny +put from application users on DEST—only queue manager delivers.
  • Grant +get only to consumer service ID, not developers’ personal IDs.
  • Monitor CURDEPTH—spike may indicate unauthorized copy accumulation.
  • Encrypt sensitive payloads at application level—MQ ACL is not encryption.

Durable Subscription Lifecycle

Durable subs persist after application disconnect—security exposure persists too. Offboard employees by removing SUB authority and DELETE SUB objects they owned, not only disabling LDAP login. Rotate MCAUSER passwords and certificates on schedule; verify old durable subs are not still bound to retired identities via SUBUSER attributes on your platform.

Managed Subscription Security

When DEST is auto-created, grant +get immediately after first DISPLAY SUB in deploy pipeline. Managed queue names are unpredictable—automate dspmqaut from captured DESTQL. Do not leave default deny while production traffic accumulates unprocessed on inaccessible queues.

Explainer: Who May Sign Up for Which Newspaper

Subscription security is controlling who may sign up (SUB), which address (DEST) deliveries are allowed to go to, and who may open that mailbox (+get)—not just whether the newspaper may be printed (PUB).

Explain Like I'm Five: Subscription Security

You check who is allowed to ask for dinosaur magazines and make sure the magazines only go to mailboxes you trust—not a stranger’s box across town.

Practice Exercises

Exercise 1

Write audit steps using DISPLAY SUB after new microservice deploy.

Exercise 2

Describe shadow subscription exfiltration and three defenses.

Exercise 3

Why separate SUB and GET grants for consumers?

Frequently Asked Questions

Frequently Asked Questions

Test Your Knowledge

Test Your Knowledge

1. Shadow subscription risk needs:

  • SUB plus writable DEST
  • Only PUB
  • Only listener
  • Only XMITQ

2. Audit tool for subs is:

  • DISPLAY SUB
  • DISPLAY CHANNEL only
  • LISTCAT
  • IEBGENER

3. Consumer needs on DEST:

  • GET
  • PUB only
  • CRT topic
  • DLT channel

4. Restrict DEFINE SUB on prod by:

  • MQ admin only plus app API under service IDs
  • All developers
  • Anonymous
  • FTP
Published
Read time18 min
AuthorMainframeMaster
Verified: IBM MQ 9.3 documentation