Details

The discover parameter specifies the discovery mode for the DB2 Administration Server. It is recommended that this parameter be set to DISABLE.

The DB2 Administration Server should not handle any type of discovery request. This will prevent a malicious user from discovering all DB2 servers on the network.

Solution

1. Attach to the DB2 instance.
db2 => attach to $DB2INSTANCE
2. Run the following command from the DB2 command window:
db2 => update admin configuration using discover disable
Default Value:
The default value for DISCOVER is SEARCH.

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/1654

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Unix.

References

• 800-53|CM-7b.
• CSCv6|9.1

Source

• Tenable.com/audits