Enable Remote TLS Connections to Db2 (DB2COMM)

HighLevel 1Manual reviewdb2

Description

The DB2COMM registry variable controls what types of remote connections Db2 will accept. It can be configured to enable plaintext communication, encrypted communication, or both.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Perform the following to determine if DB2COMM is set. 1. As the instance owner, run the following command. db2set -all DB2COMM 2. The value of DB2COMM will be returned in the output. If the DB2COMM registry variable is not set, the db2set command will not return any data. [i] TCPIP

How it is fixed

Fix method: Guidance or infrastructure patch

Perform the following to set DB2COMM and enable TLS: 1. Run the following command as the instance owner. db2set DB2COMM=SSL Db2 must be recycled (db2stop/db2start) for changes to the DB2COMM registry variable to take effect.

Properties

Operating systems: Any
Tags: db2databasemanual
Reference: CIS IBM Db2 12.1 Benchmark v1.0.0 - 8.1.11 Enable Remote TLS Connections to Db2 (DB2COMM)