Turn Off ALLOW_KEY_INSERT_WITHOUT_KEYSTORE_BACKUP

低级别 2人工审核db2

说明

The ALLOW_KEY_INSERT_WITHOUT_KEYSTORE_BACKUP setting in ekeystore.cfg file for external key managers (KMIP or PKCS11) allows writing to the keystore. The setting is false by default. Check that the setting has not been turned on.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

Check that ekeystore.cfg file that's being used has the setting turned OFF. ALLOW_KEY_INSERT_WITHOUT_KEYSTORE_BACKUP=false

修复方式

修复方法: 操作指南或基础设施补丁

$ cat ekeystore.cfg VERSION=1 PRODUCT_NAME=Luna ALLOW_KEY_INSERT_WITHOUT_KEYSTORE_BACKUP=false LIBRARY=/usr/safenet/lunaclient/luna6.1/lib/libCryptoki2_64.so SLOT_LABEL=DB2Partition NEW_OBJECT_TYPE=PRIVATE KEYSTORE_STASH=/home/db2inst1/sqllib/security/pkcs11.sth For maximum security, turn the setting off and create the keys outside of Db2. This way you will also be able to manage the labeling scheme across the Db2 instances and prevent name collision between different databases.

属性

操作系统: 任意
标签: db2databasemanual
参考: CIS IBM Db2 12.1 Benchmark v1.0.0 - 8.2.10 Turn Off ALLOW_KEY_INSERT_WITHOUT_KEYSTORE_BACKUP