STIGQter: STIG Summary: IBM DB2 V10.5 LUW Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 25 Oct 2019:

The audit information produced by DB2 must be protected from unauthorized read access.

DISA Rule

SV-89127r1_rule

Vulnerability Number

V-74453

Group Title

SRG-APP-000118-DB-000059

Rule Version

DB2X-00-002200

Severity

CAT II

CCI(s)

• CCI-000162 - The information system protects audit information from unauthorized access.

Weight

10

Fix Recommendation

Remove the write permission from non-instance owner users on the audit directory.

Remove the read permission from non-authorized users from audit directory.

Only the instance owner needs write access to directory and users authorized to archive the audit logs need to have read access to audit directory.

Change the permissions on audit datapath and archivepath directories so that only the instance owner has write access on datapath and users with audit archive privileges have read access on datapath. Only users with SYSADM and SECADM privileges and can extract and archive the audit logs.

Check Contents

Run db2audit command to find the value of datapath where the audit logs are stored.

$db2audit describe

Only the instance owner needs write access to directory and users authorized to archive the audit logs need to have read access to audit directory.

If any user other than the instance owner has write access to audit directory, this is a finding.

If any user other than the users authorized to read audit log files have read access to audit directory, this is a finding.

Vulnerability Number

V-74453

Documentable

False

Rule Version

DB2X-00-002200

Severity Override Guidance

Run db2audit command to find the value of datapath where the audit logs are stored.

$db2audit describe

Only the instance owner needs write access to directory and users authorized to archive the audit logs need to have read access to audit directory.

If any user other than the instance owner has write access to audit directory, this is a finding.

If any user other than the users authorized to read audit log files have read access to audit directory, this is a finding.

Check Content Reference

M

Target Key

3161

Comments