TMA-DB2-4.1.12
Ensure a Secure Connect Procedure is Used (CONNECT_PROC)
Description
The CONNECT_PROC stored procedure runs as part of every connection to the database and allows customization of the application environment, such as setting special registers. It could for example, set the CURRENT_PATH special register which controls the search path for finding functions and procedures to execute. Only an authorized procedure should be used.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Perform the following Db2 commands to determine if a CONNECT_PROC procedure is being used: 1. Connect to the Db2 database. db2 => connect to <dbname> 2. Run the following command: db2 => get database configuration 3. Locate the CONNECT_PROC value in the output: Connect procedure (CONNECT_PROC) = If the value is not set, this is a Pass. If a value is set, it should be reviewed to ensure it is an appropriate procedure to be run for every connection.
How it is fixed
Fix method: Guidance or infrastructure patch
To turn off the connect proc, perform the following commands: 1. Connect to the Db2 database db2 => connect to <dbname> 2. Run the following command: db2 => update database configuration using connect_proc NULL IMMEDIATE
Properties
- Operating systems
- Any
- Tags
- db2databasemanual
- Reference
- CIS IBM Db2 12.1 Benchmark v1.0.0 - 4.1.12 Ensure a Secure Connect Procedure is Used (CONNECT_PROC)