Secure Permissions for the Log Mirror Location (MIRRORLOGPATH)

OrtaDüzey 1Otomatikdb2

Açıklama

The MIRRORLOGPATH parameter specifies the type of media and the location used to store the mirror copy of the logs. It is recommended that the directory used for the mirror copy of the logs be set to full access for Db2 administrator accounts and read and execute only for all other accounts. Automated as: the MIRRORLOGPATH directory, when set, is not group- or world-writable (755 or stricter). Database-level check: set DB2DBDFT to the database name to audit (the rule connects to it with the instance owner's credentials and fails when DB2DBDFT is unset). Run as the instance owner (or with sqllib/db2profile sourced) so the db2 CLP reads this instance's configuration.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

db="${DB2DBDFT:?set DB2DBDFT to the database to audit}"; out=$(db2 get db cfg for "$db" 2>/dev/null) || exit 1; p=$(printf '%s\n' "$out" | sed -n 's/.*(MIRRORLOGPATH) *= *//p' | sed 's/[[:space:]]*$//'); [ -n "$p" ] || { echo compliant; exit 0; }; [ -e "$p" ] || { echo "noncompliant: $p does not exist"; exit 0; }; w=$(find "$p" -prune \( -perm -020 -o -perm -002 \) -print); [ -z "$w" ] && echo compliant || echo "noncompliant: $p is group/world writable"

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

For Windows and Linux: 1. Connect to the Db2 database db2 => connect to <dbname> 2. Run the following command to change the mirror log directory, if necessary: db2 => update database configuration using mirrorlogpath <valid directory> Additional steps for Windows: 1. Connect to the Db2 host 2. Right-click on the mirror log directory 3. Choose Properties 4. Select the Security tab 5. Grant all Db2 administrator accounts the Full Control authority 6. Grant all other accounts read and execute privileges only (revoke all other privileges) Additional steps for Linux: 1. Connect to the Db2 host 2. Change to the mirror log directory 3. Change the permissions for the directory $ chmod -R 755

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: db2databasefilesystemlogging
Referans: CIS IBM Db2 12.1 Benchmark v1.0.0 - 4.1.7 Secure Permissions for the Log Mirror Location (MIRRORLOGPATH)

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target db2