Table of Contents

• Overview
• License
• Description
• Setup
  • Requirements
  • Installing the db2_secured module
• Usage
• Enabling CIS for your database
• Skipping some controls
• Reference
• Limitations

Overview

This module allows you to secure your databases according to the CIS benchmark. We are also adding other security frameworks.

It is part of our family of Puppet modules to install, manage and secure DB2 databases with Puppet. Besides this module, this family also contains:

• db2_install For installing an DB2 database and other database related DB2 products
• db2_config For configuring every aspect of your DB2 database
• db2_profile The db2_profile module allows an easy path from first simple installation to a fully customized Enterprise setup.

All of these modules support DB2 versions 10 and 11.

License

This is a commercially licensed module. But you can use the module on VirtualBox based development systems for FREE. When used on real systems a license is required.

You can license our modules in multiple ways. Our basic licensing model requires a subscription per node. But contact us for details.

Check the License for details.

Description

Let’s first dive into the question: “What configuration settings are needed to get my system secure?”. Many people have asked themselves this question. The Center for Internet Security (CIS) is one of the means to get an answer. CIS also has a security baseline for DB2. We have taken this baseline and Puppetized it for you to use.

It is called db2_secured and contains an implementation of all rules in the CIS benchmark that describe a configuration setting inside of the database.

On a Puppet run, the module will inspect all settings described in the CIS rules and apply changes to them if they deviate from the standard. (If you have started the Puppet run with a noop, it will do nothing but report all changes that would have been made. ). All changes will be reported to the Puppet master and on the console, you get an overview of the changes. Because the Puppet agent runs every 20 minutes (or different if you set it to a different interval), every 20 minutes, your database configuration is checked against the CIS benchmark, and you can sleep well and be assured your data is safe.

Check the documentation here

Setup

Requirements

The db2_secured module requires:

• Puppet module enterprisemodules-easy_type installed.
• Puppet version 4.0 or higher. Can be Puppet Enterprise or Puppet Open Source
• DB2 10 higher
• A valid DB2 license
• A valid Enterprise Modules license for usage.
• Runs on most Linux systems.

Installing the db2_secured module

To install these modules, you can use a Puppetfile

mod 'enterprisemodules/db2_secured'               ,'x.x.x'

Then use the librarian-puppet or r10K to install the software.

You can also install the software using the puppet module command:

puppet module install enterprisemodules-db2_secured

Usage

The scope of securing your DB2 database is enormous. The number of security controls in the CIS benchmark is huge. This might make you think that it is not easy to get started, but actually, it is very simple.

Enabling CIS for your database

To enable the CIS benchmark on your database, you just have to add this line to your puppet code:

db2_secured::apply_cis { 'db2inst1/DB1':
  product_version  => 'db11',
  doc_version => 'V1.0.0.draft'
}

This will activate the CIS benchmark V1.1.0 draft for DB2 version 11 on your databases DB1 on database instance db2inst1. The db2_secured puppet module takes care of checking all of the security settings in the benchmark and ensuring they are set in a secure way.

Skipping some controls

The scope of the CIS benchmark for DB2 is pretty extensive. So extensive that enabling all controls, probably ensures that your application doesn't work anymore. So you need to customize the controls you want to enable.

There are four ways the db2_secured module allows you to skip controls.

1. Add a list of controls to skip when calling the db2_secured defined type.
2. Add db2_secured::controls::name_of_the_control: skip to your hiera data. This will skip the control on ALL databases.
3. Add db2_secured::controls::name_of_the_control::dbname: skip to your hiera data. This will skip the control on the database with sid dbname.
4. Add an entry with the content name_of_the_control to the array value db2_secured::skip_list in your hiera data.

Method 1 is a good way to create your own baseline based on the standard db2_secured code.

Method 2 and 3 are a perfect way to use when you need to override the applicability of control on an individual database or set of database. Just put this data in the hiera for this node or group of databases.

Method 4 is the perfect way to setup a base level. A level you want to be skipped on all of your databases.

You can combine all of these methods to fit your use case.

Reference

Here you can find some more information regarding this puppet module:

• The db2_secured documentation

Limitations

This module runs on most Linux versions. It requires a puppet version 5 or higher. The module does NOT run on windows systems.

History

03-10-2022 Version 0.4.0

• [core] Add EL9 support
• [docs] Restructure documentation

02-09-2022 Version 0.3.0

• [core] Add CIS DB11 version 1.0.0 benchmark

06-07-2022 Version 0.1.1

• [core] Fix fact resolving

01-07-2022 Version 0.1.0

• Initial release