Ensure that access to SYSIBM.SYSPACKAUTH is restricted

MittelStufe 1Manuelle Prüfungdb2-zos

Beschreibung

The SYSIBM.SYSPACKAUTH table contains the package privileges that are granted to an authorization ID or a role. PUBLIC should be restricted from accessing this table. The list of all users with access to a package should not be exposed to PUBLIC. Exposing the users who have access to packages can enable attackers to gain access to your organization's data.

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

For Db2 internal security users: Issue the following SQL statement to check if PUBLIC has access: SELECT GRANTEE FROM SYSIBM.SYSTABAUTH WHERE TCREATOR = 'SYSIBM' AND TTNAME = 'SYSPACKAUTH' AND GRANTEE = 'PUBLIC'; Output that contains zero rows is considered a successful finding. Otherwise, PUBLIC has SELECT privilege and the remediation steps should be followed. For external security users: Issue the RACF RLIST command to list the profile that controls access to the SYSIBM.SYSPACKAUTH table in the MDSNTB class. Examine the universal access (UACC) and user ... (full steps: CIS section 2.2.13)

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

For Db2 internal security users: Issue the following SQL statement to revoke access from PUBLIC: REVOKE ALL ON SYSIBM.SYSPACKAUTH FROM PUBLIC; For external security users: Issue the RACF RALTER command to update the profile and change the UACC setting to NONE. Issue the RACF PERMIT command to remove the ID(*) and specify users or groups.

Eigenschaften

Betriebssysteme: Beliebig
Tags: db2-zospermissions
Referenz: CIS IBM Db2 13 for z/OS Benchmark v1.0.0 - 2.2.13 Ensure that access to SYSIBM.SYSPACKAUTH is restricted