Secure Permissions for the Primary Archive Log Location (LOGARCHMETH1)

So wird geprüft

Prüfmethode: Shell-Befehl

db="${DB2DBDFT:?set DB2DBDFT to the database to audit}"; out=$(db2 get db cfg for "$db" 2>/dev/null) || exit 1; p=$(printf '%s\n' "$out" | sed -n 's/.*(LOGARCHMETH1) *= *//p' | sed 's/[[:space:]]*$//'); case "$p" in DISK:*) p=${p#DISK:} ;; *) echo compliant; exit 0 ;; esac; [ -n "$p" ] || { echo compliant; exit 0; }; [ -e "$p" ] || { echo "noncompliant: $p does not exist"; exit 0; }; w=$(find "$p" -prune \( -perm -020 -o -perm -002 \) -print); [ -z "$w" ] && echo compliant || echo "noncompliant: $p is group/world writable"

Erwartete Ausgabe

compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

For Windows and Linux: 1. Attach to the Db2 instance. 2. Run the following command to change the primary archive log directory, if necessary: db2 => update database configuration using logarchmeth1 <valid directory> Additional steps for Windows (assuming that the logarchmeth1 parameter includes DISK): 1. Connect to the Db2 host 2. Right-click on the primary archive log directory 3. Choose Properties 4. Select the Security tab 5. Grant all Db2 administrator accounts the Full Control authority 6. Grant all other accounts read and execute privileges only (revoke all other privileges) Additional steps for Linux (assuming that the logarchmeth1 parameter includes DISK): 1. Connect to the Db2 host 2. Change to the primary archive log directory 3. Change the permissions for the directory $ chmod -R 755

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

tmaegis scan --target db2