Secure Permissions for the Tertiary Archive Log Location (FAILARCHPATH)

Kako se proverava

Metod provere: Komanda ljuske

db="${DB2DBDFT:?set DB2DBDFT to the database to audit}"; out=$(db2 get db cfg for "$db" 2>/dev/null) || exit 1; p=$(printf '%s\n' "$out" | sed -n 's/.*(FAILARCHPATH) *= *//p' | sed 's/[[:space:]]*$//'); [ -n "$p" ] || { echo compliant; exit 0; }; [ -e "$p" ] || { echo "noncompliant: $p does not exist"; exit 0; }; w=$(find "$p" -prune \( -perm -020 -o -perm -002 \) -print); [ -z "$w" ] && echo compliant || echo "noncompliant: $p is group/world writable"

Očekivani izlaz

compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

For Windows and Linux: 1. Attach to the Db2 instance. 2. Run the following command to change the tertiary archive log directory, if necessary: db2 => update database configuration using failarchpath Additional steps for Windows (assuming that the failarchpath parameter includes DISK): 1. Connect to the Db2 host 2. Right-click on the tertiary archive log directory 3. Choose Properties 4. Select the Security tab 5. Grant all Db2 administrator accounts the Full Control authority 6. Grant all other accounts read and execute privileges only (revoke all other privileges) For Linux (assuming that the failarchpath parameter includes DISK): 1. Connect to the Db2 host 2. Change to the tertiary archive log directory 3. Change the permissions for the directory $ chmod -R 755

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

tmaegis scan --target db2