Limit OS Privileges of Fenced Mode Process (DB2_LIMIT_FENCED_GROUP)

SrednjaNivo 1Automatskadb2

Opis

The DB2_LIMIT_FENCED_GROUP registry variable allows restricting the operating system privileges of the fenced mode process (db2fmp) to the privileges assigned to the DB2USERS group. This variable only has effect if extended security is enabled (DB2_EXTSEC) and the Db2 Service Account is not LocalSystem. This registry variable only applies to Db2 Servers running on Windows. Must be ON. Default: The default value of DB2_LIMIT_FENCED_GROUP is OFF. Run as the instance owner (or with sqllib/db2profile sourced) so the db2 CLP reads this instance's configuration.

Kako se proverava

Metod provere: Komanda ljuske

shell

out=$(db2set -all 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk '/^\[[a-zA-Z]\]/ { l = $0; sub(/^\[[a-zA-Z]\] */, "", l); k = l; sub(/=.*/, "", k); v = l; sub(/^[^=]*=/, "", v); gsub(/[ \t]/, "", v); if (!(k in r)) r[k] = v } END { if (toupper(r["DB2_LIMIT_FENCED_GROUP"]) == "ON") print "compliant"; else print "noncompliant: " "DB2_LIMIT_FENCED_GROUP=" r["DB2_LIMIT_FENCED_GROUP"] }'

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Run the following command to set the DB2_LIMIT_FENCED_GROUP registry variable to ON: db2set DB2_LIMIT_FENCED_GROUP=ON

Svojstva

Operativni sistemi: Bilo koji
Oznake: db2databaseregistry
Referenca: CIS IBM Db2 12.1 Benchmark v1.0.0 - 3.2.5 Limit OS Privileges of Fenced Mode Process (DB2_LIMIT_FENCED_GROUP)

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target db2