5.9 DB2DOMAINLIST Registry Variable (Windows only)

Information

This registry variable is only active is the authentication parameter is set to CLIENT which is not a recommended setting as discussed in section 6.2. It is possible to have a user id be represented across multiple domains. Issues could arise when trying to authenticate such a user id. To prevent these issues, a listing of domains should be defined within the DB2DOMAINLIST registry variable.

Periodic review of the domain list assigned to the DB2DOMAINLIST registry variable helps ensure that non-essential domains do not have unnecessary authorizations.

Rationale:

Incorrectly configured DB2DOMAINLIST registry variable could result in unexpected authorization behavior where a low privileged user could potentially get access to sensitive data.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Run the following command to set the DB2DOMAINLIST registry variable to the appropriate domains:

db2set DB2DOMAINLIST=<ordered list of domains separated by comma>

See Also

https://workbench.cisecurity.org/benchmarks/10752

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2, CSCv7|16.6

Plugin: Windows

Control ID: 5a6405ca2ef2174222997639a6e0d2dd733e4ee9db40c1b8da97dea219d359ac