Limit OS Privileges of Fenced Mode Process (DB2_LIMIT_FENCED_GROUP)

中レベル 1自動db2

説明

The DB2_LIMIT_FENCED_GROUP registry variable allows restricting the operating system privileges of the fenced mode process (db2fmp) to the privileges assigned to the DB2USERS group. This variable only has effect if extended security is enabled (DB2_EXTSEC) and the Db2 Service Account is not LocalSystem. This registry variable only applies to Db2 Servers running on Windows. Must be ON. Default: The default value of DB2_LIMIT_FENCED_GROUP is OFF. Run as the instance owner (or with sqllib/db2profile sourced) so the db2 CLP reads this instance's configuration.

チェック方法

監査方法: シェルコマンド

shell

out=$(db2set -all 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk '/^\[[a-zA-Z]\]/ { l = $0; sub(/^\[[a-zA-Z]\] */, "", l); k = l; sub(/=.*/, "", k); v = l; sub(/^[^=]*=/, "", v); gsub(/[ \t]/, "", v); if (!(k in r)) r[k] = v } END { if (toupper(r["DB2_LIMIT_FENCED_GROUP"]) == "ON") print "compliant"; else print "noncompliant: " "DB2_LIMIT_FENCED_GROUP=" r["DB2_LIMIT_FENCED_GROUP"] }'

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Run the following command to set the DB2_LIMIT_FENCED_GROUP registry variable to ON: db2set DB2_LIMIT_FENCED_GROUP=ON

プロパティ

オペレーティングシステム: すべて
タグ: db2databaseregistry
参照: CIS IBM Db2 12.1 Benchmark v1.0.0 - 3.2.5 Limit OS Privileges of Fenced Mode Process (DB2_LIMIT_FENCED_GROUP)

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target db2