Question
Accenture
Accenture
SG
Accenture
Posted: Jun 30, 2017
Last activity: Jul 10, 2017
Last activity: 10 Jul 2017 2:31 EDT
Closed
DB2 Security Configuration
We are currently using DB Enterprise Server Edition - DB2COPY1 | Version Proprietary information hidden.
If we were implement the following configuration, will there be any impacts?
1. Revoke the IMPLICIT_SCHEMA authority from the PUBLIC group by issuing this SQL statement: "REVOKE IMPLICIT_SCHEMA ON DATABASE FROM PUBLIC;"
2. Encrypted authentication: from an IBM DB2 Console, execute "UPDATE DATABASE MANAGER CONFIGURATION USING AUTHENTICATION [method]"
The following are the secure [method]:
SERVER_ENCRYPT
DATA_ENCRYPT
KRB_SERVER_ENCRYPT
GSS_SERVER_ENCRYPT
3. Configure instance name for discovery requests: from an IBM DB2 Console, execute "UPDATE DATABASE MANAGER CONFIGURATION USING DISCOVER KNOWN"
4. Disable instance discoverability: from an IBM DB2 Console, execute "UPDATE DATABASE MANAGER CONFIGURATION USING DISCOVER_INST DISABLE"
5. Configure the KEEPFENCED parameter: "UPDATE DATABASE MANAGER CONFIGURATION USING KEEPFENCED NO"
If we were implement the following configuration, will there be any impacts?
1. Revoke the IMPLICIT_SCHEMA authority from the PUBLIC group by issuing this SQL statement: "REVOKE IMPLICIT_SCHEMA ON DATABASE FROM PUBLIC;"
2. Encrypted authentication: from an IBM DB2 Console, execute "UPDATE DATABASE MANAGER CONFIGURATION USING AUTHENTICATION [method]"
The following are the secure [method]:
SERVER_ENCRYPT
DATA_ENCRYPT
KRB_SERVER_ENCRYPT
GSS_SERVER_ENCRYPT
3. Configure instance name for discovery requests: from an IBM DB2 Console, execute "UPDATE DATABASE MANAGER CONFIGURATION USING DISCOVER KNOWN"
4. Disable instance discoverability: from an IBM DB2 Console, execute "UPDATE DATABASE MANAGER CONFIGURATION USING DISCOVER_INST DISABLE"
5. Configure the KEEPFENCED parameter: "UPDATE DATABASE MANAGER CONFIGURATION USING KEEPFENCED NO"
Posted: 7 years ago
Pegasystems Inc.
IN
Hi There,
I couldn’t say yes/no for the given changes. The best try would be to try them in lower environments to ensure nothing is breaking.
~Naresh