STIGQter: STIG Summary: IBM DB2 V10.5 LUW Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 25 Oct 2019:

DB2 must protect its audit configuration from unauthorized modification.

DISA Rule

SV-89135r1_rule

Vulnerability Number

V-74461

Group Title

SRG-APP-000122-DB-000203

Rule Version

DB2X-00-002600

Severity

CAT II

CCI(s)

• CCI-001494 - The information system protects audit tools from unauthorized modification.

Weight

10

Fix Recommendation

Update the value of SYSADM_GROUP to a group which has only authorized members.

$db2 update dbm cfg using SYSADM_GROUP <SYSADMIN GROUP>

Remove unauthorized users from the SYSADM_GROUP using the operating system tools/commands.

Revoke SECADM authority from non-authorized users using the SQL statement below:
DB2> REVOKE SECADM ON DATABASE FROM USER <user name>

Remove non-authorized members or revokes SECADM from the group or role using this SQL statement:
DB2> REVOKE SECADM ON DATABASE FROM GROUP <group name>
DB2> REVOKE SECADM ON DATABASE FROM ROLE <role name>

Revoke execute from non-authorized users if they have execute on SYSPROC.AUDIT_ARCHIVE, SYSPROC.AUDIT_LIST_LOGS, SYSPROC.AUDIT_DELIM_EXTRACT using the appropriate variation of the Revoke (routine privileges) statement.

Check Contents

Run the following command to find the value of the SYSADM_GROUP parameter:

$db2 get dbm cfg

Only authorized OS users should be part of this group. If non-authorized users are part of SYSADM_GROUP group, this is a finding.

On Windows systems, if the SYSADM_GROUP database manager configuration parameter is not specified, this is a finding.

The security administrator (who holds SECADM authority within a database) can define audit policies and control the audit requirements for an individual database. The security administrator can use the following audit routines to operate upon the database audit logs:

- The SYSPROC.AUDIT_ARCHIVE stored procedure archives audit logs.
- The SYSPROC.AUDIT_LIST_LOGS table function allows you to locate logs of interest.
- The SYSPROC.AUDIT_DELIM_EXTRACT stored procedure extracts data into delimited files for analysis.

The security administrator can also grant EXECUTE privilege on these routines to another user.

Run the following query to find out which users have SECADM authority in the database:
DB2> SELECT CHAR(GRANTOR,35) AS GRANTOR, CHAR(GRANTEE,35) AS GRANTEE, GRANTEETYPE
FROM SYSCAT.DBAUTH
WHERE SECURITYADMAUTH='Y'

If GRANTEETYPE is 'U' and the authorization ID is not an authorized user, this is a finding.

If the GRANTEETYPE is 'G', then all members of the external group identified by GRANTEE must be authorized users; otherwise, this is a finding.

If the GRANTEETYPE is 'R', then all members of the database role identified by GRANTEE must be authorized users; otherwise, this is a finding.

The members of a role can be found using this statement:
DB2> SELECT CHAR(GRANTOR,35) AS GRANTOR, CHAR(GRANTEE,35) AS GRANTEE, GRANTEETYPE
FROM SYSCAT.ROLEAUTH
WHERE ROLENAME= <search role name>

Run the following query to find out which users have execute privilege on SYSPROC.AUDIT_ARCHIVE, SYSPROC.AUDIT_LIST_LOGS, SYSPROC.AUDIT_DELIM_EXTRACT:
DB2> SELECT *
FROM SYSCAT.ROUTINEAUTH
WHERE SPECIFICNAME LIKE 'AUDIT%' AND SCHEMA='SYSPROC'

If non-authorized users have EXECUTE privilege on any of the above three routines, this is a finding.

Vulnerability Number

V-74461

Documentable

False

Rule Version

DB2X-00-002600

Severity Override Guidance

Run the following command to find the value of the SYSADM_GROUP parameter:

$db2 get dbm cfg

Only authorized OS users should be part of this group. If non-authorized users are part of SYSADM_GROUP group, this is a finding.

On Windows systems, if the SYSADM_GROUP database manager configuration parameter is not specified, this is a finding.

The security administrator (who holds SECADM authority within a database) can define audit policies and control the audit requirements for an individual database. The security administrator can use the following audit routines to operate upon the database audit logs:

- The SYSPROC.AUDIT_ARCHIVE stored procedure archives audit logs.
- The SYSPROC.AUDIT_LIST_LOGS table function allows you to locate logs of interest.
- The SYSPROC.AUDIT_DELIM_EXTRACT stored procedure extracts data into delimited files for analysis.

The security administrator can also grant EXECUTE privilege on these routines to another user.

Run the following query to find out which users have SECADM authority in the database:
DB2> SELECT CHAR(GRANTOR,35) AS GRANTOR, CHAR(GRANTEE,35) AS GRANTEE, GRANTEETYPE
FROM SYSCAT.DBAUTH
WHERE SECURITYADMAUTH='Y'

If GRANTEETYPE is 'U' and the authorization ID is not an authorized user, this is a finding.

If the GRANTEETYPE is 'G', then all members of the external group identified by GRANTEE must be authorized users; otherwise, this is a finding.

If the GRANTEETYPE is 'R', then all members of the database role identified by GRANTEE must be authorized users; otherwise, this is a finding.

The members of a role can be found using this statement:
DB2> SELECT CHAR(GRANTOR,35) AS GRANTOR, CHAR(GRANTEE,35) AS GRANTEE, GRANTEETYPE
FROM SYSCAT.ROLEAUTH
WHERE ROLENAME= <search role name>

Run the following query to find out which users have execute privilege on SYSPROC.AUDIT_ARCHIVE, SYSPROC.AUDIT_LIST_LOGS, SYSPROC.AUDIT_DELIM_EXTRACT:
DB2> SELECT *
FROM SYSCAT.ROUTINEAUTH
WHERE SPECIFICNAME LIKE 'AUDIT%' AND SCHEMA='SYSPROC'

If non-authorized users have EXECUTE privilege on any of the above three routines, this is a finding.

Check Content Reference

M

Target Key

3161

Comments