Review Users, Groups, and Roles

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

1. Review the users within your database environment: o Linux: cat /etc/passwd o Windows: 1. Run compmgmt.msc 2. Click 'Local Users and Groups' 3. Double click 'Users' 4. Review users 2. Review the groups within your database environment: o Linux: cat /etc/group o Windows: 1. Run compmgmt.msc 2. Click 'Local Users and Groups' 3. Double click 'Groups' 4. Review groups 3. Review the roles and role members within your database environment: 1. Connect to Db2 database: db2 => connect to <dbname> 2. Run the command: db2 => select rolename, grantee from syscat.roleauth where grantortype <> 'S'

How it is fixed

Fix method: Guidance or infrastructure patch

1. To remove users from your database environment: o Linux: userdel -r <user name> o Windows: 1. Run compmgmt.msc 2. Click 'Local Users and Groups' 3. Double click 'Users' 4. Right-click on 5. Select 'Delete' 2. To remove groups from your database environment: o Linux: groupdel -r <group name> o Windows: 1. Run compmgmt.msc 2. Click 'Local Users and Groups' 3. Double click 'Groups' 4. Right-click on 5. Select 'Delete' 3. To remove roles or role members from your database environment: 1. Connect to Db2 database: db2 => connect to <dbname> 2. To remove role members from roles: db2 => revoke role <role name> from <userroup/role member> 3. To remove roles: db2 => drop role <role name>