Secure Permissions for the Log Mirror Location (MIRRORLOGPATH)

Cómo se verifica

Método de auditoría: Comando de shell

db="${DB2DBDFT:?set DB2DBDFT to the database to audit}"; out=$(db2 get db cfg for "$db" 2>/dev/null) || exit 1; p=$(printf '%s\n' "$out" | sed -n 's/.*(MIRRORLOGPATH) *= *//p' | sed 's/[[:space:]]*$//'); [ -n "$p" ] || { echo compliant; exit 0; }; [ -e "$p" ] || { echo "noncompliant: $p does not exist"; exit 0; }; w=$(find "$p" -prune \( -perm -020 -o -perm -002 \) -print); [ -z "$w" ] && echo compliant || echo "noncompliant: $p is group/world writable"

Salida esperada

compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

For Windows and Linux: 1. Connect to the Db2 database db2 => connect to <dbname> 2. Run the following command to change the mirror log directory, if necessary: db2 => update database configuration using mirrorlogpath <valid directory> Additional steps for Windows: 1. Connect to the Db2 host 2. Right-click on the mirror log directory 3. Choose Properties 4. Select the Security tab 5. Grant all Db2 administrator accounts the Full Control authority 6. Grant all other accounts read and execute privileges only (revoke all other privileges) Additional steps for Linux: 1. Connect to the Db2 host 2. Change to the mirror log directory 3. Change the permissions for the directory $ chmod -R 755

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target db2