TMA-DB2-6.1.17

Secure SETSESSIONUSER Privilege

中レベル 1手動レビューdb2

説明

The SETSESSIONUSER privilege allows one user to switch the session authorization ID of the connection to another user. This allows one user to run SQL statements as another user. It is recommended that Trusted Context be used as a stronger assertion of user identity where such a feature is required.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

1. Connect to the Db2 database. db2 => connect to <dbname> 2. Run the following command: db2 => select distinct trustedid, trustedidtype, surrogateauthid, surrogateauthidtype from syscat.surrogateauthids where trustedidtype != 'C' 3. Review the list of users, groups, and roles in the above output to ensure only approved users, groups, and roles are assigned.

修正方法

修正方法: ガイダンスまたは IaC パッチ

Revoke this permission from any unauthorized users. 1. Connect to the Db2 database. db2 => connect to <dbname> 2. Run the following command: db2 => REVOKE SETSESSIONUSER ON <authid> FROM <authid>

プロパティ

オペレーティングシステム: すべて
タグ: db2databasemanual
参照: CIS IBM Db2 12.1 Benchmark v1.0.0 - 6.1.17 Secure SETSESSIONUSER Privilege