Which security values and security settings should never be left as default?
Let’s list your ROLES and Authorization IDs with some SQL queries and check the security ZPARMs
To complete this two part series, I want to do a deep dive today, down into the security innards of DB2, and to wrap up with a review of default values that can cause security concerns. A long time ago ROLEs were introduced, and, as you saw in the last newsletter, nearly all OWNERs have an associated indicator of whether they are a Role or an Authorization Id. With Roles came Trusted Contexts, and I hope that all of you out there using remote access have set up a whole bunch of Trusted Contexts.
Part 1 proposes a review of any and all GRANTs on the DB2 Directory and Catalog tables. Is your DB2 Catalog opened with a PUBLIC grant? Do you know how your DB2 z/OS System is looking on the security side ?
Role playing
To start this time, we will review the Roles that you have currently defined:
SELECT NAME
, DEFINER
, CASE DEFINERTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS DEFINERTYPE
FROM SYSIBM.SYSROLES
ORDER BY 1 , 2
FETCH FIRST 50 ROWS ONLY
WITH UR
;If this finds no rows, then that is either brilliant – you have no dynamic access – or pretty bad – you are not using Roles.
Having found your list of Roles, make sure that they are all allowed and correct. Remove any that are not supposed to be there!
It’s all a matter of context
Now the three Trusted Context Tables are to be queried:
SELECT ENABLED
, NAME
, CONTEXTID
, DEFINER
, CASE DEFINERTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS DEFINERTYPE
, DEFAULTROLE
, CASE OBJECTOWNERTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS OBJECTOWNERTYPE
, ALLOWPUBLIC
, AUTHENTICATEPUBLIC
, DEFAULTSECURITYLABEL
FROM SYSIBM.SYSCONTEXT
ORDER BY 3
FETCH FIRST 50 ROWS ONLY
WITH UR
;
This query just shows you what you have at the moment and whether or not it is active, plus the basic security information. The next two queries list out the actual details:
SELECT CONTEXTID
, AUTHID
, AUTHENTICATE
, ROLE
, SECURITYLABEL
FROM SYSIBM.SYSCONTEXTAUTHIDS
ORDER BY 1
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT CONTEXTID
, NAME
, VALUE
FROM SYSIBM.SYSCTXTTRUSTATTRS
ORDER BY 1
FETCH FIRST 50 ROWS ONLY
WITH UR
;
Note that the key is always the CONTEXTID. The NAME and VALUE pair is where you actually find the details of how a Trusted Context is defined. Again, check and validate that all these values – and especially the IP addresses – are still valid.
Do I have your Permission?
Masks and Permissions came in a while ago but haven’t gained much traction in the DB2 user community yet. However, here is an SQL to show you what you do have:
SELECT ENABLE
, CASE CONTROL_TYPE
WHEN 'R' THEN 'ROW PERMISSION'
WHEN 'M' THEN 'COLUMN MASK '
ELSE 'UNKNOWN '
END AS CONTROL_TYPE
, SCHEMA AS CREATOR
, NAME
, OWNER
, CASE OWNERTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS OWNERTYPE
FROM SYSIBM.SYSCONTROLS
ORDER BY 2 , 3 , 4
FETCH FIRST 50 ROWS ONLY
WITH UR
;
You can then easily see whether or not the permission/mask is active, or not.
SECADM to the rescue
If running with SECADM and Audit Policies, then this little query will show you what is going on:
SELECT AUDITPOLICYNAME
, OBJECTSCHEMA
, OBJECTNAME
, CASE OBJECTTYPE
WHEN 'C' THEN 'CLONE TABLE '
WHEN 'P' THEN 'IMPLICIT TABLE FOR XML COLUMN'
WHEN 'T' THEN 'TABLE '
WHEN ' ' THEN 'XML, CLONE OR TABLE '
ELSE 'ERROR AT POLICY START TIME '
END AS OBJECTTYPE
, CREATEDTS
, ALTEREDTS
, CASE DB2START
WHEN 'Y' THEN 'STARTED AT DB2 START '
WHEN 'S' THEN 'STARTED AT DB2 START. SECADM TO STOP'
WHEN 'N' THEN 'POLICY NOT STARTED AT DB2 START '
ELSE 'UNKNOWN '
END AS DB2START
, CASE CHECKING
WHEN 'A' THEN 'AUDIT ALL FAILURES '
WHEN ' ' THEN 'AUDIT NONE '
ELSE 'ERROR AT POLICY START TIME'
END AS CHECKING
, CASE VALIDATE
WHEN 'A' THEN 'AUDIT ALL FAILURES '
WHEN ' ' THEN 'AUDIT NONE '
ELSE 'ERROR AT POLICY START TIME'
END AS VALIDATE
, CASE OBJMAINT
WHEN 'A' THEN 'AUDIT ALTER/DROP '
WHEN ' ' THEN 'AUDIT NONE '
ELSE 'ERROR AT POLICY START TIME'
END AS OBJMAINT
, CASE EXECUTE
WHEN 'A' THEN 'AUDIT FIRST ACCESS '
WHEN 'C' THEN 'AUDIT FIRST UPDATE '
WHEN ' ' THEN 'AUDIT NONE '
ELSE 'ERROR AT POLICY START TIME'
END AS EXECUTE
, CASE CONTEXT
WHEN 'A' THEN 'AUDIT ALL UTILITIES '
WHEN ' ' THEN 'AUDIT NONE '
ELSE 'ERROR AT POLICY START TIME'
END AS CONTEXT
, CASE SECMAINT
WHEN 'A' THEN 'AUDIT ALL '
WHEN ' ' THEN 'AUDIT NONE '
ELSE 'ERROR AT POLICY START TIME'
END AS SECMAINT
, SYSADMIN
, DBADMIN
, DBNAME
, COLLID
FROM SYSIBM.SYSAUDITPOLICIES
ORDER BY 1
FETCH FIRST 50 ROWS ONLY
WITH UR
;
Now you can see what is happening with your policies, and are they working as designed?
Are you a ROLE model?
The next large set of queries returns *all* AUTH relevant DB2 catalog data from any DB2 Table that has any possible link to a ROLE:
SELECT GRANTOR
, CASE GRANTORTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS GRANTORTYPE
, GRANTEE
, CASE GRANTEETYPE
WHEN 'L' THEN 'ROLE '
WHEN 'P' THEN 'PACKAGE'
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS GRANTEETYPE
, CREATOR
, TNAME AS NAME
, COLNAME
, CASE PRIVILEGE
WHEN 'R' THEN 'REFERENCES'
WHEN ' ' THEN 'UPDATE '
ELSE 'UNKNOWN '
END AS PRIVILEGE
, COLLID
, HEX(CONTOKEN) AS CONTOKEN
FROM SYSIBM.SYSCOLAUTH
WHERE NOT GRANTOR = GRANTEE
ORDER BY CREATOR , NAME, COLNAME, GRANTOR, GRANTEE
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT GRANTOR
, CASE GRANTORTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS GRANTORTYPE
, GRANTEE
, CASE GRANTEETYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS GRANTEETYPE
, NAME
, CASE AUTHHOWGOT
WHEN 'C' THEN 'DBCTRL '
WHEN 'D' THEN 'DBADM '
WHEN 'E' THEN 'SECADM '
WHEN 'G' THEN 'ACCESSCTRL'
WHEN 'L' THEN 'SYSCTRL '
WHEN 'M' THEN 'DBMAINT '
WHEN 'S' THEN 'SYSADM '
WHEN ' ' THEN 'N/A '
ELSE 'UNKNOWN '
END AS AUTHHOWGOT
, CREATETABAUTH
, CREATETSAUTH
, DBADMAUTH
, DBCTRLAUTH
, DBMAINTAUTH
, DISPLAYDBAUTH
, DROPAUTH
, IMAGCOPYAUTH
, LOADAUTH
, REORGAUTH
, RECOVERDBAUTH
, REPAIRAUTH
, STARTDBAUTH
, STATSAUTH
, STOPAUTH
FROM SYSIBM.SYSDBAUTH
WHERE NOT GRANTOR = GRANTEE
ORDER BY NAME, GRANTOR, GRANTEE
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT GRANTOR
, CASE GRANTORTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS GRANTORTYPE
, GRANTEE
, CASE GRANTEETYPE
WHEN 'L' THEN 'ROLE '
WHEN 'P' THEN 'PLAN '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS GRANTEETYPE
, COLLID
, NAME
, CASE AUTHHOWGOT
WHEN 'A' THEN 'PACKADM (COLLECTION *) '
WHEN 'C' THEN 'DBCTRL '
WHEN 'D' THEN 'DBADM '
WHEN 'E' THEN 'SECADM '
WHEN 'G' THEN 'ACCESSCTRL '
WHEN 'L' THEN 'SYSCTRL '
WHEN 'M' THEN 'DBMAINT '
WHEN 'P' THEN 'PACKADM (NOT COLLECTION *)'
WHEN 'S' THEN 'SYSADM '
WHEN 'T' THEN 'DATAACCESS '
WHEN ' ' THEN 'N/A '
ELSE 'UNKNOWN '
END AS AUTHHOWGOT
, BINDAUTH
, COPYAUTH
, EXECUTEAUTH
FROM SYSIBM.SYSPACKAUTH
WHERE NOT GRANTOR = GRANTEE
ORDER BY NAME, GRANTOR, GRANTEE
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT GRANTOR
, CASE GRANTORTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS GRANTORTYPE
, GRANTEE
, CASE GRANTEETYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS GRANTEETYPE
, NAME
, CASE AUTHHOWGOT
WHEN 'C' THEN 'DBCTRL '
WHEN 'D' THEN 'DBADM '
WHEN 'E' THEN 'SECADM '
WHEN 'G' THEN 'ACCESSCTRL'
WHEN 'L' THEN 'SYSCTRL '
WHEN 'M' THEN 'DBMAINT '
WHEN 'S' THEN 'SYSADM '
WHEN ' ' THEN 'N/A '
ELSE 'UNKNOWN '
END AS AUTHHOWGOT
, BINDAUTH
, EXECUTEAUTH
FROM SYSIBM.SYSPLANAUTH
WHERE NOT GRANTOR = GRANTEE
ORDER BY NAME, GRANTOR, GRANTEE
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT GRANTOR
, CASE GRANTORTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS GRANTORTYPE
, GRANTEE
, CASE GRANTEETYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS GRANTEETYPE
, QUALIFIER
, NAME
, CASE AUTHHOWGOT
WHEN 'A' THEN 'PACKADM (COLLECTION *) '
WHEN 'C' THEN 'DBCTRL '
WHEN 'D' THEN 'DBADM '
WHEN 'E' THEN 'SECADM '
WHEN 'G' THEN 'ACCESSCTRL '
WHEN 'L' THEN 'SYSCTRL '
WHEN 'M' THEN 'DBMAINT '
WHEN 'P' THEN 'PACKADM (NOT COLLECTION *)'
WHEN 'S' THEN 'SYSADM '
WHEN 'T' THEN 'DATAACCESS '
WHEN ' ' THEN 'N/A '
ELSE 'UNKNOWN '
END AS AUTHHOWGOT
, CASE OBTYPE
WHEN 'B' THEN 'BUFFER POOL '
WHEN 'C' THEN 'COLLECTION '
WHEN 'D' THEN 'DISTINCT TYPE'
WHEN 'R' THEN 'TABLE SPACE '
WHEN 'S' THEN 'STORAGE GROUP'
WHEN 'J' THEN 'JAR FILE '
ELSE 'UNKNOWN '
END AS OBJECT_TYPE
, USEAUTH
FROM SYSIBM.SYSRESAUTH
WHERE NOT GRANTOR = GRANTEE
ORDER BY QUALIFIER, NAME, GRANTOR, GRANTEE
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT GRANTOR
, CASE GRANTORTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS GRANTORTYPE
, GRANTEE
, CASE GRANTEETYPE
WHEN 'L' THEN 'ROLE '
WHEN 'P' THEN 'PLAN/PACKAGE '
WHEN 'R' THEN 'INTERNAL USE ONLY'
WHEN ' ' THEN 'AUTH ID '
ELSE 'UNKNOWN '
END AS GRANTEETYPE
, SCHEMA AS CREATOR
, SPECIFICNAME AS NAME
, CASE ROUTINETYPE
WHEN 'F' THEN 'UDF OR CAST FUNCTION'
WHEN 'P' THEN 'STORED PROCEDURE '
ELSE 'UNKNOWN '
END AS ROUTINETYPE
, CASE AUTHHOWGOT
WHEN '1' THEN 'GRANTOR SCHEMA.* AT TIME'
WHEN 'E' THEN 'SECADM '
WHEN 'G' THEN 'ACCESSCTRL '
WHEN 'L' THEN 'SYSCTRL '
WHEN 'S' THEN 'SYSADM '
WHEN 'T' THEN 'DATAACCESS '
WHEN ' ' THEN 'N/A '
ELSE 'UNKNOWN '
END AS AUTHHOWGOT
, EXECUTEAUTH
, COLLID
, HEX(CONTOKEN) AS CONTOKEN
FROM SYSIBM.SYSROUTINEAUTH
WHERE NOT GRANTOR = GRANTEE
ORDER BY CREATOR , NAME, GRANTOR, GRANTEE
FETCH FIRST 50 ROWS ONLY
WITH UR
;SELECT GRANTOR
, CASE GRANTORTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS GRANTORTYPE
, GRANTEE
, CASE GRANTEETYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS GRANTEETYPE
, SCHEMANAME
, CASE AUTHHOWGOT
WHEN '1' THEN 'GRANTOR SCHEMA.* AT TIME'
WHEN 'E' THEN 'SECADM '
WHEN 'G' THEN 'ACCESSCTRL '
WHEN 'L' THEN 'SYSCTRL '
WHEN 'S' THEN 'SYSADM '
ELSE 'UNKNOWN '
END AS AUTHHOWGOT
, CREATEINAUTH
, ALTERINAUTH
, DROPINAUTH
FROM SYSIBM.SYSSCHEMAAUTH
WHERE NOT GRANTOR = GRANTEE
ORDER BY SCHEMANAME, GRANTOR, GRANTEE
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT GRANTOR
, CASE GRANTORTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS GRANTORTYPE
, GRANTEE
, CASE GRANTEETYPE
WHEN 'L' THEN 'ROLE '
WHEN 'P' THEN 'PLAN/PACKAGE '
WHEN 'R' THEN 'INTERNAL USE ONLY'
WHEN ' ' THEN 'AUTH ID '
ELSE 'UNKNOWN '
END AS GRANTEETYPE
, SCHEMA AS CREATOR
, NAME
, CASE AUTHHOWGOT
WHEN ' ' THEN 'N/A '
WHEN 'E' THEN 'SECADM '
WHEN 'G' THEN 'ACCESSCTRL'
WHEN 'L' THEN 'SYSCTRL '
WHEN 'S' THEN 'SYSADM '
WHEN 'T' THEN 'DATAACCESS'
ELSE 'UNKNOWN '
END AS AUTHHOWGOT
, ALTERAUTH
, USEAUTH
, COLLID
, HEX(CONTOKEN) AS CONTOKEN
FROM SYSIBM.SYSSEQUENCEAUTH
WHERE NOT GRANTOR = GRANTEE
ORDER BY CREATOR, NAME, GRANTOR, GRANTEE
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT GRANTOR
, CASE GRANTORTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS GRANTORTYPE
, GRANTEE
, CASE GRANTEETYPE
WHEN 'L' THEN 'ROLE '
WHEN 'P' THEN 'PLAN/PACKAGE'
WHEN ' ' THEN 'AUTH ID '
ELSE 'UNKNOWN '
END AS GRANTEETYPE
, DBNAME
, TCREATOR AS CREATOR
, TTNAME AS NAME
, CASE AUTHHOWGOT
WHEN ' ' THEN 'N/A '
WHEN 'B' THEN 'SYSTEM DBADM'
WHEN 'C' THEN 'DBCTRL '
WHEN 'E' THEN 'SECADM '
WHEN 'G' THEN 'ACCESSCTRL '
WHEN 'K' THEN 'SQLADM '
WHEN 'L' THEN 'SYSCTRL '
WHEN 'M' THEN 'DBMAINT '
WHEN 'S' THEN 'SYSADM '
WHEN 'T' THEN 'DATAACCESS '
ELSE 'UNKNOWN '
END AS AUTHHOWGOT
, ALTERAUTH
, DELETEAUTH
, INDEXAUTH
, INSERTAUTH
, SELECTAUTH
, UPDATEAUTH
, REFERENCESAUTH
, TRIGGERAUTH
, UPDATECOLS
, REFCOLS
, COLLID
, HEX(CONTOKEN) AS CONTOKEN
FROM SYSIBM.SYSTABAUTH
WHERE NOT GRANTOR = GRANTEE
ORDER BY CREATOR, NAME, GRANTOR, GRANTEE
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT GRANTOR
, CASE GRANTORTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS GRANTORTYPE
, GRANTEE
, CASE GRANTEETYPE
WHEN 'L' THEN 'ROLE '
WHEN 'P' THEN 'PLAN/PACKAGE'
WHEN ' ' THEN 'AUTH ID '
ELSE 'UNKNOWN '
END AS GRANTEETYPE
, CASE AUTHHOWGOT
WHEN ' ' THEN 'N/A '
WHEN 'C' THEN 'DBCTRL '
WHEN 'E' THEN 'SECADM '
WHEN 'G' THEN 'ACCESSCTRL'
WHEN 'K' THEN 'SQLADM '
WHEN 'L' THEN 'SYSCTRL '
WHEN 'M' THEN 'DBMAINT '
WHEN 'O' THEN 'SYSOPR '
WHEN 'S' THEN 'SYSADM '
ELSE 'UNKNOWN '
END AS AUTHHOWGOT
, BINDADDAUTH
, BSDSAUTH
, CREATEDBAAUTH
, CREATEDBCAUTH
, CREATESGAUTH
, DISPLAYAUTH
, RECOVERAUTH
, STOPALLAUTH
, STOSPACEAUTH
, SYSADMAUTH
, SYSOPRAUTH
, TRACEAUTH
, MON1AUTH
, MON2AUTH
, CREATEALIASAUTH
, SYSCTRLAUTH
, BINDAGENTAUTH
, ARCHIVEAUTH
, CREATETMTABAUTH
, DEBUGSESSIONAUTH
, EXPLAINAUTH
, SQLADMAUTH
, SDBADMAUTH
, DATAACCESSAUTH
, ACCESSCTRLAUTH
, CREATESECUREAUTH
FROM SYSIBM.SYSUSERAUTH
WHERE NOT GRANTOR = GRANTEE
ORDER BY GRANTOR, GRANTEE
FETCH FIRST 50 ROWS ONLY
WITH UR
;
It’s a pretty good idea to modify all of the above with an appropriate GRANTOR = or GRANTEE = predicate, as otherwise there is too much data.
You can DEPend on me!
Nearly all objects in DB2 have a dependency on another object. All of this data is stored in the xxxxxDEP tables. Some of them also have ROLE based data that could well be of interest to the security minded Person:
SELECT BSCHEMA
, BNAME
, BTYPE
, DTBCREATOR AS CREATOR
, DTBNAME AS NAME
, DTBOWNER AS OWNER
, CASE OWNERTYPE
WHEN 'R' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS OWNERTYPE
FROM SYSIBM.SYSCONSTDEP
ORDER BY DTBCREATOR , DTBNAME
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT BSCHEMA AS CREATOR
, BNAME AS NAME
, BCOLNAME AS COLUMN_NAME
, CASE BTYPE
WHEN 'A' THEN 'ALIAS '
WHEN 'C' THEN 'COLUMN '
WHEN 'F' THEN 'FUNCTION '
WHEN 'G' THEN 'GLOBAL TEMPORARY TABLE '
WHEN 'M' THEN 'MATERIALIZED QUERY TABLE'
WHEN 'Q' THEN 'SEQUENCE '
WHEN 'S' THEN 'SYNONYM '
WHEN 'T' THEN 'TABLE '
WHEN 'V' THEN 'VIEW '
WHEN 'W' THEN 'SYSTEM_TIME PERIOD '
WHEN 'Z' THEN 'BUSINESS_TIME PERIOD '
ELSE 'UNKNOWN '
END AS TYPE
, BOWNER AS OWNER
, CASE BOWNERTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS BOWNERTYPE
, DSCHEMA AS DEP_CREATOR
, DNAME AS DEP_NAME
, DCOLNAME AS DEP_COLUMN_NAME
, CASE DTYPE
WHEN 'C' THEN 'GENERATED COLUMN'
WHEN 'F' THEN 'FUNCTION '
WHEN 'I' THEN 'INDEX '
WHEN 'X' THEN 'ROW PERMISSION '
WHEN 'Y' THEN 'COLUMN MASK '
ELSE 'UNKNOWN '
END AS DEP_TYPE
, DOWNER AS DEP_OWNER
, CASE DOWNERTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS DEP_OWNERTYPE
FROM SYSIBM.SYSDEPENDENCIES
ORDER BY 1 , 2 , 3 , 5 , 7 , 8 , 9 , 11
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT ROLENAME
, DEFINER
, CASE DEFINERTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS DEFINERTYPE
, DSCHEMA AS CREATOR
, DNAME AS NAME
, CASE DTYPE
WHEN 'A' THEN 'ALIAS '
WHEN 'B' THEN 'TRIGGER '
WHEN 'D' THEN 'DATABASE '
WHEN 'E' THEN 'DISTINCT TYPE '
WHEN 'F' THEN 'USER-DEFINED FUNCTION '
WHEN 'I' THEN 'INDEX '
WHEN 'J' THEN 'JAR FILE '
WHEN 'L' THEN 'ROLE '
WHEN 'M' THEN 'MATERIALIZED QUERY TABLE'
WHEN 'N' THEN 'TRUSTED CONTEXT '
WHEN 'O' THEN 'STORED PROCEDURE '
WHEN 'Q' THEN 'SEQUENCE '
WHEN 'R' THEN 'TABLE SPACE '
WHEN 'S' THEN 'STORAGE GROUP '
WHEN 'T' THEN 'TABLE '
WHEN 'V' THEN 'VIEW '
WHEN 'X' THEN 'ROW PERMISSION '
WHEN 'Y' THEN 'COLUMN MASK '
ELSE 'UNKNOWN '
END AS TYPE
FROM SYSIBM.SYSOBJROLEDEP
ORDER BY 1 , 2
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT BQUALIFIER AS CREATOR
, BNAME AS NAME
, CASE BTYPE
WHEN 'A' THEN 'ALIAS '
WHEN 'B' THEN 'BUSINESS_TIME '
WHEN 'C' THEN 'SYSTEM_TIME '
WHEN 'F' THEN 'UDF OR CAST FUNCTION '
WHEN 'G' THEN 'GLOBAL TEMPORARY TABLE '
WHEN 'I' THEN 'INDEX '
WHEN 'M' THEN 'MATERIALIZED QUERY TABLE '
WHEN 'O' THEN 'STORED PROCEDURE '
WHEN 'P' THEN 'LARGE OR DSSIZE PART. SPACE'
WHEN 'Q' THEN 'SEQUENCE OBJECT '
WHEN 'R' THEN 'TABLESPACE '
WHEN 'S' THEN 'SYNONYM '
WHEN 'T' THEN 'TABLE '
WHEN 'U' THEN 'DISTINCT TYPE '
WHEN 'V' THEN 'VIEW '
WHEN 'W' THEN 'SYSTEM_TIME PERIOD '
WHEN 'Z' THEN 'BUSINESS_TIME PERIOD '
ELSE 'UNKNOWN '
END AS OBJECT_TYPE
, DCOLLID AS COLLECTION
, DNAME AS PACKAGE
, HEX(DCONTOKEN) AS DCONTOKEN
, CASE DTYPE
WHEN 'F' THEN 'COMPILED SQL SCALAR FUNCTION '
WHEN 'N' THEN 'NATIVE SQL ROUTINE PACKAGE '
WHEN 'O' THEN 'ORIGINAL COPY OF A PACKAGE '
WHEN 'P' THEN 'PREVIOUS COPY OF A PACKAGE '
WHEN 'R' THEN 'RESERVED FOR IBM USE '
WHEN 'T' THEN 'TRIGGER PACKAGE '
WHEN ' ' THEN 'NOT A TRIGGER/NATIVE SQL PACKAGE'
ELSE 'UNKNOWN '
END AS PACKAGE_TYPE
, DOWNER AS OWNER
, CASE DOWNERTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS DOWNERTYPE
FROM SYSIBM.SYSPACKDEP
ORDER BY 1 , 2 , 7
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT BCREATOR AS CREATOR
, BNAME AS NAME
, CASE BTYPE
WHEN 'A' THEN 'ALIAS '
WHEN 'E' THEN 'INSTEAD OF TRIGGER '
WHEN 'F' THEN 'UDF OR CAST FUNCTION '
WHEN 'G' THEN 'GLOBAL TEMPORARY TABLE '
WHEN 'I' THEN 'INDEX '
WHEN 'M' THEN 'MATERIALIZED QUERY TABLE '
WHEN 'O' THEN 'STORED PROCEDURE '
WHEN 'P' THEN 'LARGE OR DSSIZE PART. SPACE'
WHEN 'Q' THEN 'SEQUENCE OBJECT '
WHEN 'R' THEN 'TABLESPACE '
WHEN 'S' THEN 'SYNONYM '
WHEN 'T' THEN 'TABLE '
WHEN 'V' THEN 'VIEW '
ELSE 'UNKNOWN '
END AS OBJECT_TYPE
, DNAME AS PLAN_NAME
FROM SYSIBM.SYSPLANDEP
ORDER BY 1 , 2
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT DCREATOR AS CREATOR
, DNAME AS NAME
, DCOLNAME AS COLNAME
, CASE DTYPE
WHEN 'F' THEN 'SQL FUNCTION '
WHEN 'I' THEN 'IDENTITY COLUMN '
WHEN 'X' THEN 'IMPLICIT DOCID '
WHEN ' ' THEN 'OLD IDENTITY COLUMN'
ELSE 'UNKNOWN '
END AS SEQUENCETYPE
, DOWNER AS OWNER
, CASE DOWNERTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS OWNERTYPE
FROM SYSIBM.SYSSEQUENCESDEP
ORDER BY CREATOR , NAME
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT BCREATOR AS CREATOR
, BNAME AS NAME
, CASE BTYPE
WHEN 'F' THEN 'UDF OR CAST FUNCTION '
WHEN 'G' THEN 'GLOBAL TEMPORARY TABLE '
WHEN 'M' THEN 'MATERIALIZED QUERY TABLE'
WHEN 'T' THEN 'TABLE '
WHEN 'V' THEN 'VIEW '
WHEN 'W' THEN 'SYSTEM_TIME PERIOD '
WHEN 'Z' THEN 'BUSINESS_TIME PERIOD '
ELSE 'UNKNOWN '
END AS OBJECT_TYPE
, DNAME AS VIEW_NAME
, DCREATOR AS VIEW_CREATOR
, CASE DTYPE
WHEN 'F' THEN 'COMPILED SQL SCALAR FUNCTION'
WHEN 'M' THEN 'MATERIALIZED QUERY TABLE '
WHEN 'V' THEN 'VIEW '
ELSE 'UNKNOWN '
END AS TABLE_TYPE
, DOWNER AS OWNER
, CASE OWNERTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS OWNERTYPE
FROM SYSIBM.SYSVIEWDEP
ORDER BY 1 , 2 , 4 , 5
FETCH FIRST 50 ROWS ONLY
WITH UR
;
Again, judicious use of extra WHERE predicates is recommended!
ROLE based meta-data
Then there is the “base” data of the objects themselves, which can have ROLE based information in it.
SELECT NAME
, CREATOR
, CASE CREATORTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS CREATORTYPE
FROM SYSIBM.SYSDATABASE
ORDER BY 1 , 2
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT SCHEMA AS CREATOR
, NAME
, OWNER
, CASE OWNERTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS OWNERTYPE
FROM SYSIBM.SYSDATATYPES
ORDER BY 1 , 2
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT NAME
, PLNAME AS PLAN_NAME
, PLCREATOR AS CREATOR
, CASE PLCREATORTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS PLCREATORTYPE
FROM SYSIBM.SYSDBRM
ORDER BY NAME, 2
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT CREATOR
, NAME
, OWNER
, CASE OWNERTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS OWNERTYPE
FROM SYSIBM.SYSINDEXES
ORDER BY 3 , 1 , 2
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT JARSCHEMA AS CREATOR
, JAR_ID AS NAME
, OWNER
, CASE OWNERTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS OWNERTYPE
FROM SYSIBM.SYSJAROBJECTS
ORDER BY 3 , 1 , 2
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT COLLID AS COLLECTION
, NAME AS PACKAGE
, HEX(CONTOKEN) AS CONTOKEN
, CREATOR
, OWNER
, CASE OWNERTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS OWNERTYPE
FROM SYSIBM.SYSPACKAGE
ORDER BY 1 , 2 , 3
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT COLLID AS COLLECTION
, NAME AS PACKAGE
, HEX(CONTOKEN) AS CONTOKEN
, COPYID
, CREATOR
, OWNER
, CASE OWNERTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS OWNERTYPE
FROM SYSIBM.SYSPACKCOPY
ORDER BY 1 , 2 , 3 , 4
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT SCHEMA AS CREATOR
, NAME AS NAME
, OWNER AS OWNER
, CASE OWNERTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS OWNERTYPE
FROM SYSIBM.SYSPARMS
ORDER BY 1 , 2 , 3
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT CREATOR
, CASE CREATORTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS CREATORTYPE
, NAME AS NAME
, BOUNDBY
FROM SYSIBM.SYSPLAN
ORDER BY 1
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT SCHEMA AS CREATOR
, NAME
, OWNER
, CASE OWNERTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS OWNERTYPE
, ACTIVE
, CASE ROUTINETYPE
WHEN 'F' THEN 'UDF OR CAST FUNCTION'
WHEN 'P' THEN 'STORED PROCEDURE '
ELSE 'UNKNOWN '
END AS ROUTINETYPE
, CASE EXTERNAL_SECURITY
WHEN 'D' THEN 'DB2 - AUTH ID FROM WLM '
WHEN 'U' THEN 'SESSION_USER - AUTH ID OF INVOKER '
WHEN 'C' THEN 'DEFINER - AUTH ID OF OWNER OF ROUTINE'
WHEN ' ' THEN 'N/A '
ELSE 'UNKNOWN '
END AS ROUTINETYPE
, SPECIFICNAME
FROM SYSIBM.SYSROUTINES
ORDER BY CREATOR , NAME
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT SCHEMA AS CREATOR
, NAME
, OWNER
, CASE OWNERTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS OWNERTYPE
, CASE SEQTYPE
WHEN 'I' THEN 'IDENTITY COLUMN '
WHEN 'S' THEN 'USER-DEFINED SEQUENCE'
WHEN 'X' THEN 'IMPLICIT DOCID '
ELSE 'UNKNOWN '
END AS SEQUENCETYPE
FROM SYSIBM.SYSSEQUENCES
ORDER BY CREATOR , NAME
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT NAME AS CREATOR
, PLNAME AS PLAN_NAME
, PLCREATOR AS CREATOR
, CASE PLCREATORTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS PLCREATORTYPE
FROM SYSIBM.SYSSTMT
ORDER BY 2 , 1
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT NAME
, CREATOR
, CASE CREATORTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS CREATORTYPE
, CREATEDBY
FROM SYSIBM.SYSSTOGROUP
ORDER BY 1 , 2
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT NAME
, CREATOR
, CASE CREATORTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS CREATORTYPE
, TBCREATOR
, TBNAME
, CREATEDBY
FROM SYSIBM.SYSSYNONYMS
ORDER BY 1 , 2
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT OWNER
, CASE OWNERTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS OWNERTYPE
, NAME
, CREATOR
, CASE TYPE
WHEN 'A' THEN 'ALIAS '
WHEN 'C' THEN 'CLONE TABLE '
WHEN 'G' THEN 'CREATED GLOBAL TEMPORARY TABLE '
WHEN 'H' THEN 'HISTORY TABLE '
WHEN 'M' THEN 'MATERIALIZED QUERY TABLE '
WHEN 'P' THEN 'TABLE THAT WAS IMPLICITLY CREATED FOR XML'
WHEN 'T' THEN 'TABLE '
WHEN 'V' THEN 'VIEW '
WHEN 'X' THEN 'AUXILIARY TABLE '
ELSE 'UNKNOWN '
END AS TABLE_TYPE
, CASE AUDITING
WHEN ' ' THEN ' '
WHEN 'A' THEN 'AUDIT ALL '
WHEN 'C' THEN 'AUDIT CHANGE'
ELSE 'UNKNOWN '
END AS AUDIT_LEVEL
, TABLESTATUS
, CASE SECURITY_LABEL
WHEN ' ' THEN ' '
WHEN 'R' THEN 'MLS '
ELSE 'UNKNOWN'
END AS SECURITY_LABEL
, CASE CONTROL
WHEN ' ' THEN 'NO ACCESS CONTROL ENFORCEMENT'
WHEN 'B' THEN 'ROW AND COLUMN ACCESS CONTROL'
WHEN 'C' THEN 'COLUMN ACCESS CONTROL '
WHEN 'R' THEN 'ROW ACCESS CONTROL '
ELSE 'UNKNOWN '
END AS SECURITY_LABEL
, CREATEDBY
FROM SYSIBM.SYSTABLES
ORDER BY 1 , 2
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT
DBNAME
, NAME
, CREATOR
, CASE CREATORTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS CREATORTYPE
, CASE TYPE
WHEN ' ' THEN 'NORMAL '
WHEN 'G' THEN 'PBG '
WHEN 'L' THEN 'LARGE '
WHEN 'O' THEN 'LOB '
WHEN 'P' THEN 'XML PBG'
WHEN 'R' THEN 'PBR '
ELSE 'UNKNOWN'
END AS SPACE_TYPE , CASE STATUS
WHEN 'A' THEN 'OK '
WHEN 'C' THEN 'PI MISSING '
WHEN 'P' THEN 'CHECKP STATUS '
WHEN 'S' THEN 'CHECKP STATS ON A PART'
WHEN 'T' THEN 'NO TABLE DEFINED '
ELSE 'UNKNOWN '
END AS STATUS
, CREATEDBY
FROM SYSIBM.SYSTABLESPACE
ORDER BY 1 , 2
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT SCHEMA AS CREATOR
, NAME
, OWNER
, CASE OWNERTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS OWNERTYPE
, SECURE
, CASE TRIGTIME
WHEN 'A' THEN 'AFTER '
WHEN 'B' THEN 'BEFORE '
WHEN 'I' THEN 'INSTEAD'
ELSE 'UNKNOWN'
END AS TRIGGER_TIME
, CREATEDBY
FROM SYSIBM.SYSTRIGGERS
ORDER BY 1 , 2
FETCH FIRST 50 ROWS ONLY
WITH UR
;
SELECT CREATOR
, NAME
, OWNER
, CASE OWNERTYPE
WHEN 'L' THEN 'ROLE '
WHEN ' ' THEN 'AUTH ID'
ELSE 'UNKNOWN'
END AS OWNERTYPE
, CASE TYPE
WHEN 'F' THEN 'UDF OR CAST FUNCTION '
WHEN 'M' THEN 'MATERIALIZED QUERY TABLE'
WHEN 'V' THEN 'VIEW '
ELSE 'UNKNOWN '
END AS TABLE_TYPE
FROM SYSIBM.SYSVIEWS
ORDER BY 1 , 2
FETCH FIRST 50 ROWS ONLY
WITH UR
;
Once more: Add your own WHERE predicates here please!
Lost in translation
Finally, and the last SQL for this newsletter, is for the Inbound and Outbound AUTHID translation table:
SELECT AUTHID
, CASE TYPE
WHEN 'I' THEN 'INBOUND AND COME-FROM CHECKING '
WHEN 'O' THEN 'OUTBOUND TRANSLATION '
WHEN 'S' THEN 'OUTBOUND SYSTEM AUTHID FOR TRUSTED CONNECTION'
ELSE 'UNKNOWN '
END AS NAME_TYPE
, NEWAUTHID
FROM SYSIBM.USERNAMES
ORDER BY 1
FETCH FIRST 50 ROWS ONLY
WITH UR
;
We have now gone through all the Role based, and some more, DB2 Catalog tables. What about seeing what is happening on your machine? Have you anything in place that can give you 100% coverage of audit issues? With Software Engineering’s SQL WorkloadExpert for DB2 z/OS you can audit everything that is running in your enterprise. For example here is a view of the Audit pop-up window:
In the bottom half you can see the Authorization failures radio button. This shows all -551 SQL Codes and also the +562 “ping” of a double GRANT. Why this? Well, to prove that the Audit is actually alive and well you should do a “dummy” GRANT every day like, for example,
GRANT SELECT ON SYSIBM.SYDUMMY1 TO PUBLIC ;
that is already there and therefore gets a +562 which is also externalized and available in this selection. This way auditors can see that the Audit trace was running and so any -551 would also be there.
You also get GRANTs and REVOKEs and DDL that is running – optionally the software can even generate the DDL so you can follow the lifecycle of changes over time. All very handy stuff and available real-time!
Death by Default?
Now onto the last part of these newsletters: Default settings which can harm security.
Here’s a little list of any security ZPARM or BSDS settings that should never ever be left “as default”.
| What | Default | Where |
| Catalog Alias | DSNCAT | CATALOG Zparm |
| Group Name | DSNCAT | GRPNAME Zparm |
| Member Name | DSN1 | MEMBNAME Zparm |
| SSID | DSN1 | DSNHDECP module |
| Command prefix | –DSN1 | n/a |
| SYSADM 1 | SYSADM | SYSADM Zparm |
| SYSADM 2 | SYSADM | SYSADM2 Zparm |
| SYSOPER 1 | SYSOPER | SYSOPER Zparm |
| SYSOPER 2 | SYSOPER | SYSOPER2 Zparm |
| Security Admin 1 | SECADM | SECADM1 Zparm |
| Security Admin 2 | SECADM | SECADM2 Zparm |
| Unknown Userid | IBMUSER | DEFLTID Zparm |
| If using DDF: | | |
| DB2 Location Name | LOC1 | BSDS |
| DB2 LU Name | LU1 | BSDS |
| DRDA Port | 446 | BSDS |
| SECURE Port | 448 | BSDS |
If you have any of the above values in your shop – Time to plan some changes!
I hope you enjoyed this last part of a Quick Security Audit. Thanks again for reaching the end.
As always, any questions or comments would be most welcome!
TTFN,
Roy Boxwell
