Secure Permissions for Default Database File Path (DFTDBPATH)

チェック方法

監査方法: シェルコマンド

out=$(db2 get dbm cfg 2>/dev/null) || exit 1; p=$(printf '%s\n' "$out" | sed -n 's/.*(DFTDBPATH) *= *//p' | sed 's/[[:space:]]*$//'); [ -n "$p" ] || { echo compliant; exit 0; }; [ -e "$p" ] || { echo "noncompliant: $p does not exist"; exit 0; }; w=$(find "$p" -prune \( -perm -020 -o -perm -002 \) -print); [ -z "$w" ] && echo compliant || echo "noncompliant: $p is group/world writable"

期待される出力

compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

For Windows and Linux: 1. Attach to the Db2 instance. db2 => attach to <db2instance> 2. Run the following command to change the default file path, if necessary: db2 => update database manager configuration using dftdbpath <valid directory> Additional steps for Windows: 1. Connect to the Db2 host 2. Right-click over the directory used as the default file path 3. Choose Properties 4. Select the Security tab 5. Assign ownership of the directory to the Db2 Administrator 6. Grant all Db2 administrator accounts the Full Control authority 7. Grant only read and execute privileges to all other users (revoke all other privileges) Additional steps for Linux: 1. Connect to the Db2 host 2. Change to the directory used as the default file path 3. Assign the Db2 Administrator to be the owner of the directory using the chown command 4. Change the permissions for the directory $ chmod -R 755

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

tmaegis scan --target db2