Ensure that access to the catalog tables in the communications database (CDB) is restricted

中级别 1人工审核db2-zos

说明

The communications database (CDB) is a set of Db2 catalog tables that can be configured to control aspects of outbound and inbound connection requests. The SYSIBM.LOCATIONS table and SYSIBM.USERNAMES table are configured for using TCP/IP or SNA protocol. PUBLIC access to these tables exposes connection information for remote Db2 access, which can compromise the security of the server.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

For Db2 internal security users: Issue the following SQL statement to check if PUBLIC has access: SELECT GRANTEE, TCREATOR, TTNAME FROM SYSIBM.SYSTABAUTH WHERE TCREATOR = 'SYSIBM' AND TTNAME IN ('LOCATIONS', 'IPNAMES', 'IPLIST', 'LUNAMES', 'LULIST', 'LUMODES', 'MODESELECT', 'USERNAMES') AND GRANTEE = 'PUBLIC'; Output that contains zero rows is considered a successful finding. Otherwise, PUBLIC has SELECT, INSERT, UPDATE, or DELETE privilege and the remediation steps should be followed. For external security users: Issue the RACF RLIST command to list the ... (full steps: CIS section 2.2.1)

修复方式

修复方法: 操作指南或基础设施补丁

For Db2 internal security users: Issue the SQL REVOKE statement to revoke access from PUBLIC. For external security users: Issue the RACF RALTER command to update the profiles and change the UACC setting to NONE. Issue the RACF PERMIT command to remove the ID(*) and specify users or groups.

属性

操作系统: 任意
标签: db2-zospermissions
参考: CIS IBM Db2 13 for z/OS Benchmark v1.0.0 - 2.2.1 Ensure that access to the catalog tables in the communications database (CDB) is restricted