SEO

Hi,

The way authorities are granted in DB2 are very vague.In one of our
production systems the users under staff group in AIX have sysmon
authorities and i have checked dbm cfg and there sysmon_group is empty.
So how every member of staff have sysmon authority.why so?

How can a user run "db2 list applications" and db2 "get snapshot ....."
with these authorities?


db2 get authorizations

Administrative Authorizations for Current User

Direct SYSADM authority = NO
Direct SYSCTRL authority = NO
Direct SYSMAINT authority = NO
Direct DBADM authority = NO
Direct CREATETAB authority = NO
Direct BINDADD authority = NO
Direct CONNECT authority = YES
Direct CREATE_NOT_FENC authority = NO
Direct IMPLICIT_SCHEMA authority = NO
Direct LOAD authority = NO
Direct QUIESCE_CONNECT authority = NO
Direct CREATE_EXTERNAL_ROUTINE authority = NO
Direct SYSMON authority = NO

Indirect SYSADM authority = NO
Indirect SYSCTRL authority = NO
Indirect SYSMAINT authority = NO
Indirect DBADM authority = NO
Indirect CREATETAB authority = NO
Indirect BINDADD authority = NO
Indirect CONNECT authority = NO
Indirect CREATE_NOT_FENC authority = NO
Indirect IMPLICIT_SCHEMA authority = NO
Indirect LOAD authority = NO
Indirect QUIESCE_CONNECT authority = NO
Indirect CREATE_EXTERNAL_ROUTINE authority = NO
Indirect SYSMON authority = NO

Dibur wrote:
> Hi,
>
> The way authorities are granted in DB2 are very vague.In one of our
> production systems the users under staff group in AIX have sysmon
> authorities and i have checked dbm cfg and there sysmon_group is empty.
> So how every member of staff have sysmon authority.why so?
>
> How can a user run "db2 list applications" and db2 "get snapshot ....."
> with these authorities?

Is SYSADM_GROUP set to STAFF?

Is the DB2_SNAPSHOT_NOAUTH registry variable set?

Dibur wrote:

> Hi,
>
> The way authorities are granted in DB2 are very vague.In one of our
> production systems the users under staff group in AIX have sysmon
> authorities and i have checked dbm cfg and there sysmon_group is empty.
> So how every member of staff have sysmon authority.why so?

Which groups does the user belong to?
Which groups have you configured in your DBM CFG?

--
Knut Stolze
DB2 Information Integration Development
IBM Germany

Hey Ian!!

Thanks a lot for reminding DB2_SNAPSHOT_NOAUTH ......i did used it
earlier, infact it was me who had set up that variable long time back
in the same server i mention in my post.

People say u forget things when u fall in love


Ian wrote:
> Dibur wrote:
> > Hi,
> >
> > The way authorities are granted in DB2 are very vague.In one of our
> > production systems the users under staff group in AIX have sysmon
> > authorities and i have checked dbm cfg and there sysmon_group is empty.
> > So how every member of staff have sysmon authority.why so?
> >
> > How can a user run "db2 list applications" and db2 "get snapshot ....."
> > with these authorities?
>
> Is SYSADM_GROUP set to STAFF?
>
> Is the DB2_SNAPSHOT_NOAUTH registry variable set?