Secure Permissions for the Primary Archive Log Location (LOGARCHMETH1)

Trung bìnhCấp 1Tự độngdb2

Mô tả

The LOGARCHMETH1 parameter specifies the type of media and the location used as the primary destination of archived logs. It is recommended that the directory used for the archived logs be set to full access for Db2 administrator accounts and read and execute for all other accounts. Automated as: when LOGARCHMETH1 is DISK:<dir>, that directory is not group- or world-writable (755 or stricter); other methods pass. Database-level check: set DB2DBDFT to the database name to audit (the rule connects to it with the instance owner's credentials and fails when DB2DBDFT is unset). Run as the instance owner (or with sqllib/db2profile sourced) so the db2 CLP reads this instance's configuration.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

db="${DB2DBDFT:?set DB2DBDFT to the database to audit}"; out=$(db2 get db cfg for "$db" 2>/dev/null) || exit 1; p=$(printf '%s\n' "$out" | sed -n 's/.*(LOGARCHMETH1) *= *//p' | sed 's/[[:space:]]*$//'); case "$p" in DISK:*) p=${p#DISK:} ;; *) echo compliant; exit 0 ;; esac; [ -n "$p" ] || { echo compliant; exit 0; }; [ -e "$p" ] || { echo "noncompliant: $p does not exist"; exit 0; }; w=$(find "$p" -prune \( -perm -020 -o -perm -002 \) -print); [ -z "$w" ] && echo compliant || echo "noncompliant: $p is group/world writable"

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

For Windows and Linux: 1. Attach to the Db2 instance. 2. Run the following command to change the primary archive log directory, if necessary: db2 => update database configuration using logarchmeth1 <valid directory> Additional steps for Windows (assuming that the logarchmeth1 parameter includes DISK): 1. Connect to the Db2 host 2. Right-click on the primary archive log directory 3. Choose Properties 4. Select the Security tab 5. Grant all Db2 administrator accounts the Full Control authority 6. Grant all other accounts read and execute privileges only (revoke all other privileges) Additional steps for Linux (assuming that the logarchmeth1 parameter includes DISK): 1. Connect to the Db2 host 2. Change to the primary archive log directory 3. Change the permissions for the directory $ chmod -R 755

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: db2databasefilesystemlogging
Tham chiếu: CIS IBM Db2 12.1 Benchmark v1.0.0 - 4.1.4 Secure Permissions for the Primary Archive Log Location (LOGARCHMETH1)

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target db2