Secure CONNECT Authority

MediumLevel 1Manual reviewdb2

Description

The CONNECT role grants the authority to a user to connect to mainframe and midrange databases from Windows, Unix, and Linux operating systems. It is recommended that the CONNECT role be granted to authorized users only.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

1. Connect to the Db2 database. db2 => connect to <dbname> 2. Run the following command: db2 => select distinct grantee, granteetype from syscat.dbauth where connectauth = 'Y' 3. Review the list of users, groups, and roles in the above output to ensure only approved users, groups, and roles are assigned.

How it is fixed

Fix method: Guidance or infrastructure patch

Revoke this permission from any unauthorized users. 1. Connect to the Db2 database. db2 => connect to <dbname> 2. Run the following command: db2 => REVOKE CONNECT ON DATABASE FROM USER <username>

Properties

Operating systems: Any
Tags: db2databasemanual
Reference: CIS IBM Db2 12.1 Benchmark v1.0.0 - 6.1.13 Secure CONNECT Authority