TMA-DB2-4.2.2

Restrict Access to SYSCAT.AUDITUSE

SrednjaNivo 1Automatskadb2

Opis

The SYSCAT.AUDITUSE view contains database audit policy for all non-database objects, such as authority, groups, roles, and users. It is recommended that the PUBLIC role be restricted from accessing this view. Counts grants to PUBLIC on SYSCAT.AUDITUSE (SYSCAT.TABAUTH); 0 is required. Database-level check: set DB2DBDFT to the database name to audit (the rule connects to it with the instance owner's credentials and fails when DB2DBDFT is unset). Run as the instance owner (or with sqllib/db2profile sourced) so the db2 CLP reads this instance's configuration.

Kako se proverava

Metod provere: SQL upit

sql_query

db="${DB2DBDFT:?set DB2DBDFT to the database to audit}"; db2 connect to "$db" >/dev/null || exit 1; db2 -x "select count(*) from syscat.tabauth where tabschema = 'SYSCAT' and tabname = 'AUDITUSE' and grantee = 'PUBLIC'"; rc=$?; db2 connect reset >/dev/null 2>&1; db2 terminate >/dev/null 2>&1; exit $rc

Očekivani izlaz: 0

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Revoke access from PUBLIC. 1. Connect to the Db2 database. db2 => connect to <dbname> 2. Run the following command: db2 => REVOKE SELECT ON SYSCAT.AUDITUSE FROM PUBLIC

Svojstva

Operativni sistemi: Bilo koji
Oznake: db2databaseprivilegescatalog
Referenca: CIS IBM Db2 12.1 Benchmark v1.0.0 - 4.2.2 Restrict Access to SYSCAT.AUDITUSE

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target db2