Limit OS Privileges of Fenced Mode Process (DB2_LIMIT_FENCED_GROUP)

SedangLevel 1Otomatisdb2

Deskripsi

The DB2_LIMIT_FENCED_GROUP registry variable allows restricting the operating system privileges of the fenced mode process (db2fmp) to the privileges assigned to the DB2USERS group. This variable only has effect if extended security is enabled (DB2_EXTSEC) and the Db2 Service Account is not LocalSystem. This registry variable only applies to Db2 Servers running on Windows. Must be ON. Default: The default value of DB2_LIMIT_FENCED_GROUP is OFF. Run as the instance owner (or with sqllib/db2profile sourced) so the db2 CLP reads this instance's configuration.

Cara pemeriksaan

Metode audit: Perintah shell

shell

out=$(db2set -all 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk '/^\[[a-zA-Z]\]/ { l = $0; sub(/^\[[a-zA-Z]\] */, "", l); k = l; sub(/=.*/, "", k); v = l; sub(/^[^=]*=/, "", v); gsub(/[ \t]/, "", v); if (!(k in r)) r[k] = v } END { if (toupper(r["DB2_LIMIT_FENCED_GROUP"]) == "ON") print "compliant"; else print "noncompliant: " "DB2_LIMIT_FENCED_GROUP=" r["DB2_LIMIT_FENCED_GROUP"] }'

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Run the following command to set the DB2_LIMIT_FENCED_GROUP registry variable to ON: db2set DB2_LIMIT_FENCED_GROUP=ON

Properti

Sistem operasi: Apa saja
Tag: db2databaseregistry
Referensi: CIS IBM Db2 12.1 Benchmark v1.0.0 - 3.2.5 Limit OS Privileges of Fenced Mode Process (DB2_LIMIT_FENCED_GROUP)

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target db2