TMA-DB2-6.1.5
Secure SECADM Authority
Beschreibung
The SECADM (security administrator) role grants the authority to create, alter (where applicable), and drop roles, trusted contexts, audit policies, security label components, security policies and security labels. It is also the authority required to grant and revoke roles, security labels and exemptions, and the SETSESSIONUSER privilege. SECADM authority has no inherent privilege to access ...
So wird geprüft
Prüfmethode: Manuelle Prüfung
Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.
1. Connect to the Db2 database. db2 => connect to <dbname> 2. Run the following command: db2 => select distinct grantee, granteetype from syscat.dbauth where securityadmauth = 'Y' 3. Review the list of users, groups, and roles in the above output to ensure only approved users, groups, and roles are assigned.
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
Revoke this permission from any unauthorized users. 1. Connect to the Db2 database. db2 => connect to <dbname> 2. Run the following command: db2 => REVOKE SECADM ON DATABASE FROM USER <username>
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- db2databasemanual
- Referenz
- CIS IBM Db2 12.1 Benchmark v1.0.0 - 6.1.5 Secure SECADM Authority