7.3 Secure SYSMAINT Authority

Information

The sysmaint_group parameter defines the system administrator group that possesses the system maintenance (SYSMAINT) authority. It is recommended that the sysmaint_group group contains authorized users only.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Define a valid group name for the SYSMAINT group.
1. Attach to the DB2 instance.
db2 => attach to $DB2INSTANCE
2. Run the following command from the DB2 command window-
db2 => update database manager configuration using sysmaint_group <sys maintenance group name>
Default Value - The default value for sysmaint_group is NULL.

See Also

https://workbench.cisecurity.org/files/162

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(5), CSCv6|5.1

Plugin: Unix

Control ID: 79e4fbaf4f4a703290f098179246659a6cc15f97f616ad18f51e066a12dee307