TMA-DB2-4.1.1

Creating the Database Without PUBLIC Grants (RESTRICTIVE)

MediaNivel 2Automatizadadb2

Descripción

This parameter indicates whether the database was created with the RESTRICTIVE clause in the CREATE DATABASE statement. When creating a database, the use of the RESTRICTIVE clause will cause certain privileges to be revoked from PUBLIC. RESTRICT_ACCESS = YES means the database was created with the RESTRICTIVE clause. Database-level check: set DB2DBDFT to the database name to audit (the rule connects to it with the instance owner's credentials and fails when DB2DBDFT is unset). Run as the instance owner (or with sqllib/db2profile sourced) so the db2 CLP reads this instance's configuration.

Cómo se verifica

Método de auditoría: Consulta SQL

sql_query

db="${DB2DBDFT:?set DB2DBDFT to the database to audit}"; db2 connect to "$db" >/dev/null || exit 1; db2 -x "select value from sysibmadm.dbcfg where name = 'restrict_access'"; rc=$?; db2 connect reset >/dev/null 2>&1; db2 terminate >/dev/null 2>&1; exit $rc

Salida esperada: YES

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

There is no remediation for this parameter due to the fact that the placement of the RESTRICTIVE clause happens within the CREATE DATABASE statement. Unless your backup strategies allow for a complete overhaul of your environment where you are able to recreate the database with the RESTRICTIVE clause, we do not recommend changing this parameter. However, if you would like to align your database configuration to that which the RESTRICTIVE clause would provide, please ensure the following: 1. SYSCAT.DBAUTH - Ensure PUBLIC is NOT granted the following authorities: o CREATETAB o BINDADD o CONNECT o IMPLICIT_SCHEMA 2. SYSCAT.TABAUTH - Ensure PUBLIC is NOT granted the following privileges: o SELECT on all SYSCAT and SYSIBM tables o SELECT and UPDATE on all SYSSTAT tables o SELECT on the following views in schema SYSIBMADM: - ALL_* - USER_* - ROLE_* - SESSION_* - DICTIONARY - TAB 3. ...

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: db2databaseprivileges
Referencia: CIS IBM Db2 12.1 Benchmark v1.0.0 - 4.1.1 Creating the Database Without PUBLIC Grants (RESTRICTIVE)

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target db2 --level 2