DB2 Authorities

SYSADM, SYSCTRL, SYSMAINT, and SYSMON are instance-level authorities. have to update in DBM CFG
DBADM, LOAD, and SECADM authorities are assigned to a user or group for a particular database


SYSADM
it is like as a ROOT for the database
db2 update dbm cfg using SYSADM_GROUP <group_name>


SYSCTRL
SYSCTRL authority can perform all administrative and maintenance commands within the instance. However, unlike SYSADM users, they cannot access any data within the databases unless they are granted the privileges
db2 update dbm cfg using SYSCTRL_GROUP <group_name>
like:
• db2start/db2stop
• db2 create/drop database
• db2 create/drop tablespace
• db2 backup/restore/rollforward database
• db2 runstats (against any table)
• db2 update db cfg for database dbname


SYSMAINT
The commands that a user with SYSMAINT authority can issue are a subset of those allowed to users with SYSCTRL authority. SYSMAINT users can only perform tasks related to maintenance
db2 update dbm cfg using SYSMAINT_GROUP <group_name>
like:
• db2start/db2stop
• db2 backup/restore/rollforward database
• db2 runstats (against any table)
• db2 update db cfg for database dbname


SYSMAINT
a user with SYSMAINT authority can issue are a subset of those allowed to users with SYSCTRL authority. SYSMAINT users can only perform tasks related to maintenance
db2 update dbm cfg using SYSMAINT_GROUP group name
like:
• db2start/db2stop
• db2 backup/restore/rollforward database
• db2 runstats (against any table)
• db2 update db cfg for database dbname


SYSMON 
SYSMON authority provides the ability to take database system monitor snapshots of a database manager instance or its databases.
db2 update dbm cfg using SYSMON_GROUP group name
like:
• GET DATABASE MANAGER MONITOR SWITCHES
• GET MONITOR SWITCHES
• GET SNAPSHOT
• LIST ACTIVE DATABASES
• LIST APPLICATIONS
• LIST DCS APPLICATIONS
• RESET MONITOR
• UPDATE MONITOR SWITCHES
• db2GetSnapshot - Get snapshot
• db2GetSnapshotSize - Estimate size required for db2GetSnapshot() output buffer
• db2MonitorSwitches - Get/update monitor switches
• db2ResetMonitor - Reset monitor
Users with the SYSADM, SYSCTRL, or SYSMAINT authority level also possess SYSMON authority.


DBADM
DBADM authority is a database-level authority rather than an instance-level authority. DBADM users have complete control over a database almost. DBADM users cannot perform such maintenance or administrative tasks
SYSADM provide this access
db2 grant dbadm on database to user tst1
db2 grant dbadm on database to group db2grp1
like:
• drop database
• drop/create tablespace
• backup/restore database
• update db cfg for database db name
• db2 create/drop table
• db2 grant/revoke (any privilege)
• db2 runstats (any table)


LOAD
LOAD authority is also considered a database-level authority, and can therefore be granted to both users and groups. As the name implies, LOAD authority allows users to issue the LOAD command against a table. The LOAD command is typically used as a faster alternative to insert or import commands when populating a table with large amounts of data.
SYSADM or DBADM provide this access
db2 grant load on database to user tst1
db2 grant insert on table sales to user tst1
db2 grant load on database to group grp1
db2 grant delete on table sales to group grp1
db2 grant insert on table sales to group grp1
like:
• db2 quiesce tablespaces for table
• db2 list tablespaces
• db2 runstats (any table)
• db2 load insert (must have insert privilege on table)
• db2 load restart/terminate after load insert (must have insert privilege on table)
• db2 load replace (must have insert and delete privilege on table)
• db2 load restart/terminate after load replace (must have insert and delete privilege on table)


SECADM
SECADM authority is considered a database-level authority, but can only be granted to a specific user by a SYSADM user
like:
• Create and drop security label components
• Create and drop security policies
• Create and drop security labels
• Grant and revoke security labels
• Grant and revoke LBAC rule exemptions
• Grant and revoke setsessionuser privileges
• Execute the SQL statement TRANSFER OWNERSHIP on objects that you do not own




njoy the simplicity.......
©Atul Singh

victimizeit.blogspot.com

Steps to configure DB2 to support remote TCP/IP clients

Hi there...

Sometimes we need to add port which can be listen by DB2. As DB2 can listen any port no lying between 1 to 64000. By default DB2 is using the port no 5000 but in any case if we have to change it to other so here I am describing it.

1. Add an entry to the TCP/IP Services file that looks similar to the following example:
db2c1svc        50000/tcp              # DB2 Instance connection port for instance DB2C1

 

The service name db2c1svc can be any name you choose, but must be unique in the Services file and must match the value you specify for the SVCENAME parameter in the DBM CFG file.
The port number you specify should be an integer greater than 1024. The port numbers must be unique within the Services file.
The maximum length for the SVCENAME value is 14 characters. This parameter is case sensitive.
The tcp after the port number must be in lower case.

 

2. On a Linux or UNIX system, the services file is located in the directory path of /etc/services. You must be root to update it. On a Windows system, the Services file is located in the directory path of \windows\system32\drivers\etc\services.

3. On an AIX system, synchronize the /etc/services file and the inetd daemon by executing the following commands:
# inetimp
# refresh -s inetd

** We can add the DB2 service name in DBM CFG file by executing the following commands

db2> update dbm cfg SVCENAME <service_name>

i.e
db2> update dbm cfg SVCENAME db2c1svc

 njoy the simplicity.......
©Atul Singh

victimizeit.blogspot.com

How to change the database name

Hello friends,

       Now we can change the DB name, Instance name with the help of DB2RELOCATEDB tool.
       We can do below things with this tool
      

• Changing a database name
• Changing the path/drive that a database was created on
• Changing one or more table space containers
• Changing the log path associated with the database
• Changing the instance associated with a database
• Copying/moving a database to the same (or different) machine

      This tool can be found at these location on UNix/Windows

        UNIX:     Instance directory/sqllib/bin/db2relocatedb
   Windows:  Installed drive\sqllib\bin\db2relocatedb.exe

Command syntax:
db2relocatedb -f <config_file>

config file format is:


     DB_NAME=oldName,newName
     DB_PATH=oldPath,newPath
     INSTANCE=oldInst,newInst
     NODENUM=nodeNumber
     LOG_DIR=oldDirPath,newDirPath
     CONT_PATH=oldContPath1,newContPath1
     CONT_PATH=oldContPath2,newContPath1
     STORAGE_PATH=oldStoragePath1,newStoragePath1

     ...

Example:

Our environment:
- Database Name: prod1
- Database Path: /home/db2inst1
- Instance: db2inst1

Create a file called: changeDbName with the following format:

DB_NAME=prod1,prod2
DB_PATH=/home/db2inst1
INSTANCE=db2inst1

and execute the command:
db2relocatedb -f changeDbName

After the change our environment will be:
- Database Name: prod2
- Database Path: /home/db2inst1
- Instance: db2inst1

Notes:

*  Database name, database path, and instance name are all required fields. If one of these fields is not changing then it is not
   necessary to list the old and new value for it, just give the old/current one.
*  Blank lines or lines beginning with a comment character (#) will be ignored.

For Further details, go through this link...
The DB2RELOCATEDB tool

 njoy the simplicity.......
©Atul Singh

victimizeit.blogspot.com

How to Prevent someone else from reseting your root password in NIX

If you are an even slightly security-consious sysadmin, the previous sections must have set off alarms while you were reading them. Is it really that easy to hack Linux? Yes and No. It all it comes down to the following: Physical Access is Root Access. Meaning, if you give someone physical access to a system, then you are giving them a very good chance of getting root access on your box. This is true for Windows, Linux, or any other OS out there.
But… you say that you need to give some people physical access to the server? There are some precautions you can take to slow down attackers and stop the noob’s. In this section I will talk about various ways you can make your computer more secure against these types of attacks. So lets get started.
3.1.1 Password protecting GRUB and LILO
First, edit the /etc/inittab file and insert the following line, right after the “initdefault” line: ~~:S:wait:/sbin/sulogin. This will require a password to boot into single-user mode by making init run ‘sulogin’ before dropping the machine to a root shell. ‘sulogin’ requires the user to input the root password before continuing.
Unfortunately, the above step won’t protect us against people who know what they are doing and pass init=/bin/bash to the kernel at the LILO prompt. To prevent unauthorized access I would suggest that you password protect LILO/GRUB by following these steps:


How to Protect LILO:
Open a shell prompt and log in as root
Open /etc/lilo.conf in your favorite text editor
Add the following line before the first image stanza: password=<password> , where <password> is your password.
Run /sbin/lilo -v to let the changes take effect
Type chmod 600 /etc/lilo.conf to give only root access to read and edit the file since all passwords are in plain text
Relax a bit, as your system is a little bit more secure


How to password-protect GRUB
Open a shell prompt and log in as root
Type /sbin/grub-md5-crypt and press enter
Enter the password you chose for GRUB when prompted. This will return an MD5 hash of your password
Open /boot/grub/grub.conf in your favorite text editor
Add password –md5 <password-hash> below the timeout in the main section (Replace <password-hash> with the hash you got in the previous step)
Save and exit
The next time you reboot, the GRUB menu will not let you access the editor or command interface without first pressing [p] followed by the GRUB password.



njoy the simplicity.......
©Atul Singh

victimizeit.blogspot.com

Resetting the Password of a user differently in NIX

Hi Friends..

In some of the Linux distributions, including Ubuntu, when you go to recovery mode to reset the password of root or any other user, the user's current password would be prompted. To circumvent this, boot with a Live CD of the Linux distribution and edit the /etc/passwd file using vi or any editor of convenience.

As you must be aware, the fields in the file are separated by ':' (colon) character and the second field is the password of the user. In Linux this value is set to 'x' to indicate that the password is stored in /etc/shadow file in encrypted form. Just remove this 'x' character from the file and let the field be empty against the user whose password needs to be reset. Now, reboot this Linux machine and during the booting process hit 'Alt + F1' to open up a console. You would be prompted for the user name to login to. Once the username is entered the shell prompt comes up without requiring any password.

Now you can reset the password without the need to the previous password.

I hope this little Tip will create curiosity in your mind to explore Linux more and you will know more about it. ;-)


njoy the simplicity.......
©Atul Singh

victimizeit.blogspot.com

DataStage 8.5 Installation on windows

Hi Guys

I am back with the new things, DATASTAGE
Today we will learn how to install the DataStage 8.5 on Windows XP




Please comment.


njoy the simplicity.......
©Atul Singh

victimizeit.blogspot.com