Detections
Analytics

9.5 Review role grantees with the WITH ADMIN OPTION clause

Information

Using the WITH ADMIN OPTION clause of the GRANT (Role) SQL statement, the security administrator can delegate the management and control of membership in a role to someone else.

The WITH ADMIN OPTION clause gives another user the authority to grant membership in the role to other users, to revoke membership in the role from other members of the role, and to comment on a role, but not to drop the role.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

1. Attach to DB2 Instance:
db2 => attach to $DB2INSTANCE
2. Connect to DB2 database:
db2 => connect to $DBNAME
3. Perform the following command:
db2=> revoke admin option for role <role name> from user <user name>
10 DB2 Utilities and Tools

See Also

https://workbench.cisecurity.org/files/1654

Item Details

Plugin: IBM_DB2DB

Control ID: c4966e63e62f2ccd9832f9338db60c4575d3992218117f84130e957cfdb88c79