TMA-DB2-ZOS-1.2.5

Separate security administration from system administration

높음레벨 1수동 검토db2-zos

설명

The SEPARATE_SECURITY subsystem parameter allows you to separate security administrator duties from the Db2 system administrator duties when using native Db2 authorization. It is recommended to set SEPARATE_SECURITY=YES. When SEPARATE_SECURITY is set to YES, SECADM authority is required for security administration.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Run the DSNTEJ6Z job to obtain the current value of the SEPARATE_SECURITY subsystem parameter. Verify that the value is set to YES.

조치 방법

조치 방식: 가이드 또는 인프라 패치

1. Ensure that the current SQLID is one of the authorization IDs of the process for applications that use SYSADM authority to set current SQLID. 2. Ensure that the binder has BINDAGENT privilege from the owner for the bind and rebind processes that use SYSADM, SYSCTRL, or system DBADM authority to specify the OWNER keyword. 3. Edit the DSNTIJUZ job and set the DSN6SPRM.SEPARATE_SECURITY parameter to YES. 4. Submit DSNTIJUZ to assemble the subsystem parameter. 5. Either issue the -SET SYSPARM command or stop and restart Db2 to activate the changes.

속성

운영 체제: 모두
태그: db2-zoshardening
참고 자료: CIS IBM Db2 13 for z/OS Benchmark v1.0.0 - 1.2.5 Separate security administration from system administration