Restrict Access to SYSCAT.COLAUTH

中级别 1自动化db2

说明

The SYSCAT.COLAUTH view contains the column privileges granted to the user or a group of users. It is recommended that the PUBLIC role be restricted from accessing this view. Counts grants to PUBLIC on SYSCAT.COLAUTH (SYSCAT.TABAUTH); 0 is required. Database-level check: set DB2DBDFT to the database name to audit (the rule connects to it with the instance owner's credentials and fails when DB2DBDFT is unset). Run as the instance owner (or with sqllib/db2profile sourced) so the db2 CLP reads this instance's configuration.

检查方式

审计方法: SQL 查询

sql_query

db="${DB2DBDFT:?set DB2DBDFT to the database to audit}"; db2 connect to "$db" >/dev/null || exit 1; db2 -x "select count(*) from syscat.tabauth where tabschema = 'SYSCAT' and tabname = 'COLAUTH' and grantee = 'PUBLIC'"; rc=$?; db2 connect reset >/dev/null 2>&1; db2 terminate >/dev/null 2>&1; exit $rc

预期输出: 0

修复方式

修复方法: 操作指南或基础设施补丁

Perform the following to revoke access from PUBLIC. 1. Connect to the Db2 database. db2 => connect to <dbname> 2. Run the following command: db2 => REVOKE SELECT ON SYSCAT.COLAUTH FROM PUBLIC

属性

操作系统: 任意
标签: db2databaseprivilegescatalog
参考: CIS IBM Db2 12.1 Benchmark v1.0.0 - 4.2.3 Restrict Access to SYSCAT.COLAUTH

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target db2