Turn Off Remote Command Legacy Mode (DB2RCMD_LEGACY_MODE)

中等級 1自動化db2

說明

The DB2RCMD_LEGACY_MODE registry variable determines whether the Db2 Remote Command Service runs with enhanced security or not. It is recommended that legacy mode not be enabled. This registry variable only applies to Db2 Servers running on Windows. Unset or OFF passes. Default: The default value of DB2RCMD_LEGACY_MODE is OFF. Run as the instance owner (or with sqllib/db2profile sourced) so the db2 CLP reads this instance's configuration.

檢查方式

稽核方法: Shell 指令

shell

out=$(db2set -all 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk '/^\[[a-zA-Z]\]/ { l = $0; sub(/^\[[a-zA-Z]\] */, "", l); k = l; sub(/=.*/, "", k); v = l; sub(/^[^=]*=/, "", v); gsub(/[ \t]/, "", v); if (!(k in r)) r[k] = v } END { if (!("DB2RCMD_LEGACY_MODE" in r) || toupper(r["DB2RCMD_LEGACY_MODE"]) == "OFF") print "compliant"; else print "noncompliant: " r["DB2RCMD_LEGACY_MODE"] }'

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Run the following command to set the DB2RCMD_LEGACY_MODE registry variable to OFF: db2set DB2RCMD_LEGACY_MODE=OFF

屬性

作業系統: 不限
標籤: db2databaseregistry
參考資料: CIS IBM Db2 12.1 Benchmark v1.0.0 - 3.2.2 Turn Off Remote Command Legacy Mode (DB2RCMD_LEGACY_MODE)

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target db2