IBM DB2 record

/api/2.0/fo/auth/ibm_db2/

[POST]

Create, update, list and delete IBM DB2 records for vulnerability and compliance scans (using VM, PC). This record is used for authenticated scanning of one or more DB2 instances on a single host. Want to scan multiple instances? See "Multiple DB2 Instances" in online help.

Requirement - You must set up target hosts per the Qualys User Guide.

Download Qualys User Guide - IBM DB2 Authentication (.zip)

Input Parameters

Parameter

Description

action={action}

(Required) Specify create, update, delete (using POST) or list (using GET or POST). See List Auth Records for type

echo_request={0|1}

(Optional) Specify 1 to view (echo) input parameters in the XML output. By default these are not included.

ids={value}

(Required to update or delete record) Record IDs to update/delete. Specify record IDs and/or ID ranges (for example, 1359-1407). Multiple entries are comma separated.

title={value}

(Required to create record) The title for the record. The title must be unique and may include a maximum of 255 characters (ascii).

comments={value}

(Optional) User defined notes about the record. Maximum of 1999 characters (ascii).

pc_only={0|1}

(Optional to create or update record) Specify pc_only=1 if the record will be used for compliance scans only.

Login Credentials

 

username={value}

(Required to create record, optional to update record) The user name for a DB2 database account. A maximum of 13 characters (ascii) may be specified.

password={value}

(Required to create record, optional to update record) The password for a DB2 database account. Maximum 100 characters (ascii).

database={value}

(Required to create record, optional to update record) The name of the DB2 database. A maximum of 8 characters (ascii) may be specified.

port={value}

(Required to create record, optional to update record) The port the database instance is running on.

Target Hosts

 

ips={value}

(Required to create record, optional to update record) Add IP addresses of the hosts you want to scan using this record.

Overwrites (replaces) the IP address(es) in the IP list for an existing authentication record. The IPs you specify are added, and any existing IPs are removed. You may enter a combination of IPs and IP ranges.

add_ips={value}

(Optional to update record) Add IP address(es) to the IP list for an existing authentication record. You may enter a combination of IPs and IP ranges.

remove_ips={value}

(Optional and valid to update record) IPs to be removed from your record. You may enter a combination of IPs and ranges. Multiple entries are comma separated.

network_id={value}

(Optional to create or update record, and valid when the networks feature is enabled) The network ID for the record.

OS Parameters

 

win_db2dir={value}

unix_db2dir={value}

The path to the DB2 runtime library if you want the service to perform OS-dependent compliance checks. This is the location where DB2 has been installed on the server. Maximum of 255 characters.

win_prilogfile={value}

unix_prilogfile={value}

The path to the primary archive location if you want the service to perform OS-dependent compliance checks. This is the directory where the primary log files are located. Maximum of 255 characters.

win_seclogfile={value}

unix_seclogfile={value}

The path to the secondary archive location if you want the service to perform OS-dependent compliance checks. Maximum of 255 characters. This parameter specifies the number of secondary log files that are created and used for recovery log files (only as needed). It is set by the DB2 logsecond parameter.

win_terlogfile={value}

unix_terlogfile={value}

The path to the tertiary archive location if you want the service to perform OS-dependent compliance checks. Maximum 255 characters.

This parameter specifies a path to which DB2 will try to archive log files if the log files cannot be archived to either the primary or the secondary (if set) archive destinations because of a media problem affecting those destinations. It is set by the DB2 failarchpath parameter.

win_mirlogfile={value}

unix_mirlogfile={value}

The path to the mirror archive location if you want the service to perform OS-dependent compliance checks. Maximum 255 characters.

If mirrorlogpath is configured, DB2 will create active log files in both the log path and the mirror log path. All log data will be written to both paths. The mirror log path has a duplicate set of active log files. If the active log files are destroyed by a disk error or human error, the database can still function.  

 

Multiple DB2 Instances

The service has the ability to authenticate to multiple DB2 instances on a single host during scanning. For a vulnerability scan, an instance "uniqueness" is defined by an IP address and port. For a compliance scan, an instance "uniqueness" is defined by an IP address, port and database name. The setting for "pc_only" has an impact on how the services determines the uniqueness of a DB2 instance.

DB2 Paths

When specifying the path to configuration files, these special characters are not allowed:

For Windows:

; & | # % ? ! * ` ( ) [ ] ” ’ > < = ^ /

For Unix:

; & | # % ? ! * ` ( ) [ ] ” ’ > < = ^ \

DTDs for auth type "ibm_db2"

<platform API server>/api/2.0/batch_return.dtd

<platform API server>/api/2.0/fo/auth/ibm_db2/auth_ibm_db2_list_output.dtd