4.1.12 Set Maximum Number of Applications (MAXAPPLS)

Information

The MAXAPPLS parameter specifies the maximum number of concurrent applications that can be connected (both local and remote) to a database. In an instance with a single database, it is recommended that this value be set to AUTOMATIC. While this indicates that any number of connections should be allowed, an upper limit of MAX_CONNECTIONS database manager configuration parameter is still enforced. If there are multiple databases within the instance, then the sum of MAXAPPLS for each database should be less than or equal to MAX_CONNECTIONS.

When AUTOMATIC is used, MAXAPPLS can also have a parameter. The value is not used to determine the maximum number of connections, but rather for dependent parameters, such as PCKCACHESZ and CATALOG_CACHESZ that can derive their value from MAXAPPLS. In such a case the value specified with AUTOMATIC should represent the expected number of connections.

Rationale:

By default, Db2 allows an unlimited number of users to access the Db2 instance. In addition to giving access to the Db2 instance to authorized users only, it is recommended to set a limit to the number of users allowed to access a Db2 instance. This helps prevent denial of service conditions should an authorized process malfunction and attempt many simultaneous connections.

Impact:

Increasing the value of this parameter without lowering the MAXLOCKS parameter or increasing the LOCKLIST parameter could cause you to reach the database limit on locks (LOCKLIST) rather than the application limit and as a result cause pervasive lock escalation problems.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Connect to the Db2 database

db2 => connect to <dbname>

If a single database is used in the instance, run the following command:

db2 => update database configuration using maxappls AUTOMATIC

If multiple databases are used in the instance, determine appropriate values for each database such that the sum of MAXAPPLS values equals the MAX_CONNECTIONS database manager configuration parameter value (for example 100 for each of 2 databases when MAX_CONNECTIONS is 200), and run the following command:

db2 => update database configuration using maxappls 200

See Also

https://workbench.cisecurity.org/benchmarks/10752

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-6

Plugin: Windows

Control ID: 5b09f12659775a3545a4d8e22555d77a4152fdc0f20628cf78559d35374bfbc8