Customize security parameters

You can configure your own rule for security parameters in IBM® Db2® Data Management Console to adjust the security strength.

Configure User ID rule

Although IBM Db2 Data Management Console delegates authentication to external security systems, define a restriction pattern for user ID is still a good security practice.

In IBM Db2 Data Management Console, the default rules for user ID is:

  • Total length from 1 to 128 characters;
  • Allowed characters are lower-case letters(a-z), numbers(0-9), underscore(_), hyphen(-), dot(.), at(@) and comma(,);
  • Begin with a lower-case letter or number.
To define your own user ID rule:
  1. Navigate to the \Config folder of your IBM Db2 Data Management Console installation and open the dswebserver_override.properties file.
  2. Add the following property value:
    userid.rule=<a regular expression for user ID>
  3. Save the file and restart IBM Db2 Data Management Console.
Note: The user ID is always case insensitive.

Append customized HTTP response headers to web resources

If you want to set a rule to restrict the loading of web resource to preventing attacks like Clickjacking or XSS, you can append your own headers to HTTP responses.

To define your own user ID rule:
  1. Open the bootstrap.properties file.
    <dmc_install_location>/wlp/usr/servers/dsweb/bootstrap.properties
  2. Add the following property value:
    http.response.append.header=<header_name1:header_value1;header_name2:header_value2;...>

    For example:

    http.response.append.header=X-Frame-Options:DENY
    Note: To set the Referrer-Policy, append the following customized HTTP response header to web resources:
    http.response.append.header=Referrer-Policy:no-referrer-when-downgrade
  3. Save the file and restart IBM Db2 Data Management Console.

Verify server host name or IP address

If you want to prevent 'Host Header Injection' attack that someone intercept your HTTP requests and replace the value of host header, you can configure a white list of host names and IP address of your server where IBM Db2 Data Management Console is installed to enable verification of the host header.

  1. Navigate to the \Config folder of your IBM Db2 Data Management Console installation and open the dswebserver_override.properties file.
  2. Add the following property value:
    allowed_hostname_list=<host_name_or_ip_1,host_name_or_ip_2,...>
  3. Save the file and restart IBM Db2 Data Management Console.

You can only access the service of IBM Db2 Data Management Console through the host name or IP address you configured in the property value.

Customize several JSSE security properties

To meet the latest security requirement, IBM Db2 Data Management Console has overwritten some of the default JSSE security properties of IBM SDK, Java Technology Edition, Version 8.

If you want to customize these properties and to have an even more strength security rule, you can modify the values of following properties.

To change the disabled algorithm list used in TLS/SSL communications.
  1. Open the dmc.security file.
    <dmc_install_location>/wlp/usr/servers/dsweb/dmc_security
  2. Modify the following property value:
    jdk.tls.disabledAlgorithms
  3. Save the file and restart IBM Db2 Data Management Console.
To change the key size of the EXPORT_DHE cipher suites (which is not recommended) and set a customized key size
  1. Open the bootstrap.properties file.
    <dmc_install_location>/wlp/usr/servers/dsweb/bootstrap.properties
  2. Edit the following property value:
    jdk.tls.ephemeralDHKeySize

    For example:

    jdk.tls.ephemeralDHKeySize=2048
  3. Save the file and restart IBM Db2 Data Management Console.

Customize idle timeout value

You can add a customized idle timeout value that will automatically log off the console after 'x' minutes of user inactivity.

To change the idle timeout value:
  1. Open the dswebserver_override.properties file.
    <dmc_install_location>/Config/dswebserver_override.properties
  2. Add the following property value:
    idle_timeout=x_Mins
  3. Save the file and refresh the browser.

For example, to specify the timeout value as 10 minutes, add the following property value.

idle_timeout=10

This causes the console to automatically logoff after 10 minutes of inactivity (no keyboard or mouse movement).

To reset the timeout value in the file to the default value of 30 minutes, go to path/to/dmc/Config/dswebserver_override.properties file and delete the timeout value that was previously set. The value of idle_timeout property must be empty. Refresh the browser for the timeout value to be set to the default value of 30 minutes.