OWASP Backend Security Project DB2 Hardening

= Overview =

Historically DB2 has lived on a mainframe and resided in a fairly secure network. More and more we see DB2 exposed to the large world and used as backend for web applications. With these changes in DB2 comes increased risk.

This paragraph has the objectives to define the minimum security requirements for configuring and managing DB2 databases, in terms of access to, configuration and management of the system, and to supply guidelines and operation instructions for system administrators, in order to guarantee the development of secure applications on DB2 platforms.

= Description =

Configuring Accounts and Groups
Unlike Oracle and Microsoft SQL Server, which support database authentication and database accounts, DB2 exclusively uses the operating system for authentication purposes. What this means is that DB2 is immune to attackers gaining access via database accounts without a password, or accounts that have a default password. Indeed, when DB2 is installed some OS accounts are created and, in earlier versions of DB2, these OS accounts were given default passwords.

DB2 accounts must be subject to the same control and administration rules as other accounts in operating systems. In particular, you must verify if accounts are redundant or have not been used at least once. Database administrators must periodically verify and possibly rectify privileges, groups and functions assigned to accounts, in order to guarantee that permissions assigned to users correspond to their real working needs.

Ensure you have enabled password management features with for example a password lockout to 10 and password expiration to 90 days. The account expiration date must be set for accounts for users whose period of work is defined and limited in time.

*NIX platforms
It is advisable to change the default user-ids installed at the moment of database installation or by 3rd party products. By default, the DB2 Setup wizard creates these user and group accounts automatically during a DB2 UDB server installation. Installed with the database there are some DB2 users (db2inst1, db2fenc1, and dasusr1):

db2inst1:x:1001:1001::/home/db2inst1:/bin/sh db2fenc1:x:1002:1002::/home/db2fenc1:/bin/sh dasusr1:x:1003:1003::/home/dasusr1:/bin/sh

You need to modify the initial passwords (ibmdb2). To do this, run these three commands:

passwd db2inst1 passwd db2fenc1 passwd dasusr1

Some others accounts could be present after database or 3rd party products installation, they are:

db2inst[n]/ibmdb2       0 < n < 10        (db2inst2, db2inst3, ..., db2inst9) db2fenc[n]/ibmdb2       0 < n < 10        (db2fenc2, db2fenc3, ..., db2fenc9) db2ins[n]/ibmdb2        9 < n < 100       (db2ins10, db2ins11, ..., db2ins99) db2fen[n]/ibmdb2        9 < n < 100       (db2fen10, db2fen11, ..., db2fen99) db2as/ibmdb2 dlfm/ibmdb2 db2admin/db2admin

It is advisable to change all the default password.

Windows platforms
Beginning in DB2 UDB Version 8.2, a security option was added as part of the DB2 UDB installation to create two additional groups in the operating system, DB2USERS and DB2ADMNS. Once these groups are created, only user accounts that are members of these groups will have access to the DB2 UDB files on the system (including commands as well as user data files created by DB2 UDB).

DB2ADMNS    this group and local managers have complete access to DB2 objects through the operating system DB2USERS    this group has read and execution access to the DB2 objects through the operating system

Ensure you have changed default password for db2admin account and you have enabled this option during the original DB2 UDB installation. You can always enable it at a later time by running the db2secv82.exe program. This program can be found in the DB2PATH\SQLLIB\BIN\ directory, where DB2PATH is the location where DB2 UDB was installed. You should enable this option in order to secure your server to the greatest extent.

Configuring Authorisations
The appropriate authorisations allowed to the previously created user must be chosen by indicating which authorisations database you want to grant.

One or more authorisations can be allowed, according to the real need for the following privileges:

schema privileges table privileges index privileges view privileges tablespace privileges function privileges procedure privileges method privileges package privileges

In order to facilitate the process of monitoring accounts and their relative authorisations, DB2 automatically manages this information using its system catalogue containing the following views:

SYSCAT.DBAUTH:			lists authorisations inherent to the database; SYSCAT.TABAUTH:		lists authorisations inherent to tables and views; SYSCAT.COLAUTH:		lists authorisations inherent to columns; SYSCAT.PACKAGEAUTH:	lists authorisations inherent to packages; SYSCAT.INDEXAUTH:		lists authorisations inherent to indexes; SYSCAT.SCHEMAAUTH:		lists authorisations inherent to schemas; SYSCAT.PASSTHRUAUTH:	lists authorisations inherent to servers; SYSCAT.ROUTINEAUTH:		lists authorisations inherent to routines (functions, methods, or stored procedures).

Auditing Events
= References =


 * DB2 Security and Compliance Solutions for Linux, UNIX, and Windows - Whei-Jen Chen, Ivo Rytir, Paul Read, Rafat Odeh - IBM Redbooks
 * Hardening DB2 - Giuseppe Gottardi - Internal at Communication Valley S.p.A.