Security Pertemuan 7 Matakuliah: T0413 Tahun: 2009

Bina Nusantara University 3 Security Overview Authentication Authorization Is this right password for Bob? Does Bob have an authorization to perform SELECT to MYTABLE? CONNECT TO sample USER bob using pwd SELECT * FROM mytable Mytable  DB2 uses a combination of: ƒExternal security service ƒInternal access control information  Authentication ƒIdentify the user –Check entered user name and password ƒDone by security facility outside of DB2 (Part of the OS, DCE, and so forth)  Authorization ƒCheck if authenticated user may perform requested operation ƒDone by DB2 facilities –Information stored in DB2 catalog, DBM configuration file

Bina Nusantara University 4  When client and server are different machines, where is userid/password is checked?  DBM CFG Parameter (at the DB2 server): AUTHENTICATION = SERVER (default)  Valid values: ƒ SERVER (default) ƒ CLIENT – authorization takes place on the client ƒ SERVER_ENCRYPT – Like SERVER except user IDs and passwords are encrypted ƒ KERBEROS – Authentication takes place using a Kerberos security mechanism ƒ SQL_AUTHENTICATION_DATAENC – Server authentication plus connections must use data encryption ƒ SQL_AUTHENTICATION_DATAENC_CMP – Like above, except data encryption only used when available ƒ GSSPLUGIN – Authentication uses an external GSS API-based plug-in security mechanism Authentication

Bina Nusantara University 5 Client DB2 Server AUTHENTICATION=SERVER AUTHENTICATION=CLIENT connect... using user1/pwd1 user1/pwd1 exists here connect Authentication (cont’d)

Bina Nusantara University 6 AUTHORIZATION

Bina Nusantara University 7 Other Authority Levels Grant/Revoke DBADM Establish/Change SYSCTRL Establish/Change SYSMAINT Establish/Change SYSMON Force users off database Create/Drop database Restore to new database Update DB CFG Backup database/table space Restore to existing database Perform roll-forward recovery Start/Stop instance Restore table space Run trace Obtain monitor snapshots Query table space state Prune log history files Quiesce table space LOAD tables Set/Unset check-pending status Create/Drop event monitors YES Update DBM CFG YES FunctionSYSADMSYSCTRLSYSMAINTSYSMONLOADDBADM

Bina Nusantara University 8  Users of a DB2 database are controlled by native OS authentication services. ƒ Free database/sysadmin/users from having to deal with multiple logins/password.  SYSADM, SYSCTRL & SYSMAINT are defined by OS groups in DBM CFG –update dbm cfg using SYSADM_GROUP –update dbm cfg using SYSCTRL_GROUP –update dbm cfg using SYSMAINT_GROUP  Each instance has its own authority group definitions  On Windows, parameters are not set by default, implying local Windows Administrators group SYS Authorities

Bina Nusantara University 9  DBADM = Super user for the database. No authority at instance level  Example: connect to sample grant DBADM on database to user DBADM Authority

Bina Nusantara University 10 Launching the Table Privileges Dialog Control Center > (expand) All Databases Folder > (expand) Tables Folder > (right-click) Table > Privileges

Bina Nusantara University 11 Table Privileges Dialog Grant all privileges Revoke all privileges Specify privileges for additional users Use Tabs to choose between specifying privileges for Users or Groups Permissions available to grant for this database object “YES” = grant user permission “NO” = do NOT grant user permission “GRANT” = grant user permission + permission to grant this privilege to other users

Bina Nusantara University 12  ANY user id identifiable by the operating system/network authentication service belongs automatically to the PUBLIC group  The following are granted to PUBLIC by default: ƒ CONNECT ƒ CREATE TAB ƒ IMPLICIT_SCHEMA ƒ BINDADD  To "lock down" your system, you can revoke these privileges from PUBLIC The PUBLIC group

Bina Nusantara University 13  GRANT SELECT ON TABLE T1 TO USER user1  GRANT ALL ON TABLE T1 TO GROUP group1  REVOKE ALL ON TABLE T1 FROM GROUP group1  GRANT EXECUTE ON PROCEDURE p1 TO USER user1  REVOKE EXECUTE ON PROCEDURE p1 FROM USER user1  REVOKE CONNECT ON DATABASE FROM PUBLIC  REVOKE CREATETABON DATABASE FROM PUBLIC  REVOKE IMPLICIT_SCHEMA ON DATABASE FROM PUBLIC  REVOKE BINDADD ON DATABASE FROM PUBLIC GRANT and REVOKE examples

Bina Nusantara University 14 Extended Security (Windows only) To control access to DB2 system files through the operating system DB2ADMNS Windows group –This group and local administrators will have complete access to all DB2 objects through the operating system. DB2USERS Windows group –This group will have read and execute access to all DB2 objects through the operating system.