Turn Off Remote Command Legacy Mode (DB2RCMD_LEGACY_MODE)

中级别 1自动化db2

说明

The DB2RCMD_LEGACY_MODE registry variable determines whether the Db2 Remote Command Service runs with enhanced security or not. It is recommended that legacy mode not be enabled. This registry variable only applies to Db2 Servers running on Windows. Unset or OFF passes. Default: The default value of DB2RCMD_LEGACY_MODE is OFF. Run as the instance owner (or with sqllib/db2profile sourced) so the db2 CLP reads this instance's configuration.

检查方式

审计方法: Shell 命令

shell

out=$(db2set -all 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk '/^\[[a-zA-Z]\]/ { l = $0; sub(/^\[[a-zA-Z]\] */, "", l); k = l; sub(/=.*/, "", k); v = l; sub(/^[^=]*=/, "", v); gsub(/[ \t]/, "", v); if (!(k in r)) r[k] = v } END { if (!("DB2RCMD_LEGACY_MODE" in r) || toupper(r["DB2RCMD_LEGACY_MODE"]) == "OFF") print "compliant"; else print "noncompliant: " r["DB2RCMD_LEGACY_MODE"] }'

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Run the following command to set the DB2RCMD_LEGACY_MODE registry variable to OFF: db2set DB2RCMD_LEGACY_MODE=OFF

属性

操作系统: 任意
标签: db2databaseregistry
参考: CIS IBM Db2 12.1 Benchmark v1.0.0 - 3.2.2 Turn Off Remote Command Legacy Mode (DB2RCMD_LEGACY_MODE)

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target db2