TMA-DB2-4.2.5

Restrict Access to SYSCAT.COLGROUPDIST

MittelStufe 1Automatisiertdb2

Beschreibung

The SYSCAT.COLGROUPDIST view contains the nth most frequent value of the column group or the nth quantile value of the column group. It is recommended that the PUBLIC role be restricted from accessing this view. Counts grants to PUBLIC on SYSCAT.COLGROUPDIST (SYSCAT.TABAUTH); 0 is required. Database-level check: set DB2DBDFT to the database name to audit (the rule connects to it with the instance owner's credentials and fails when DB2DBDFT is unset). Run as the instance owner (or with sqllib/db2profile sourced) so the db2 CLP reads this instance's configuration.

So wird geprüft

Prüfmethode: SQL-Abfrage

sql_query

db="${DB2DBDFT:?set DB2DBDFT to the database to audit}"; db2 connect to "$db" >/dev/null || exit 1; db2 -x "select count(*) from syscat.tabauth where tabschema = 'SYSCAT' and tabname = 'COLGROUPDIST' and grantee = 'PUBLIC'"; rc=$?; db2 connect reset >/dev/null 2>&1; db2 terminate >/dev/null 2>&1; exit $rc

Erwartete Ausgabe: 0

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Perform the following to revoke access from PUBLIC. 1. Connect to the Db2 database. db2 => connect to <dbname> 2. Run the following command: db2 => REVOKE SELECT ON SYSCAT.COLGROUPDIST FROM PUBLIC

Eigenschaften

Betriebssysteme: Beliebig
Tags: db2databaseprivilegescatalog
Referenz: CIS IBM Db2 12.1 Benchmark v1.0.0 - 4.2.5 Restrict Access to SYSCAT.COLGROUPDIST

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target db2