IFCID106: System Parameters (security-relevant fields only)
The IFCID106 DD contains the extracted IFCID106 (System Parameters) records.
The
IFCID106 DD has the following five sections for the security-relevant fields:- System initialization parameters
- Miscellaneous installation parameters
- Distributed Data Facility (DDF) parameters
- Data sharing parameters
- Application programming defaults
Fields for system initialization parameters
The IFCID106 DD has the following fields for system initialization parameters:- WTO ROUTE CODES
- The MVS console routing codes. These codes are assigned to messages that are not solicited from a specific console. Up to 16 comma-separated codes can be shown.
- MONITOR BUFFER SIZE
- The default number of bytes allocated for the monitor trace buffer.
- AUDIT CLASSES
- Shows whether the audit trace is started automatically when Db2 is started. When a value of YES is specified, the audit trace is started for the default class (class 1) whenever Db2 is started. When a value of ALL is specified, an audit trace is automatically started for all classes.
- EXT. SECURITY
- Extended security options. When the recommended value of YES is specified, detailed reason codes are returned to a DRDA level 3 client when a DDF connection request fails because of security errors. When using SNA protocols, the requester must have included a product that supports the extended security sense codes, such as Db2 Connect version 5 and subsequent releases. RACF® users can change their passwords using the DRDA change password function. This support is only for DRDA level 3 requesters that have implemented support for changing passwords. A value of YES allows properly-enabled DRDA clients to determine the cause of security failures without requiring Db2 operator support. When a value of NO is specified, generic error codes are returned to the clients and RACF users are prevented from changing their passwords.
- UNICODE IFCIDS
- Shows whether output from IFC records should contain character data in Unicode or EBCDIC. Only a subset of the character fields (identified in the IFCID record definition by a %U in the comment area to the right of the field declaration in the DSNDQWxx copy files) are encoded in Unicode. The remaining fields maintain the same encoding of previous releases.
Example for system initialization parameters
SYSTEM INITIALIZATION PARAMETERS
WTO ROUTE CODES : X'8000' MONITOR BUFFER SIZE: 0001048576 AUDIT CLASSES: X'00000000' EXT. SECURITY: NO
DATABASE PROTOCOL: D UNICODE IFCIDS : NO Fields for miscellaneous installation parameters
The IFCID106 DD has the following fields for miscellaneous installation parameters:- COMCRIT
- Indicates whether the Db2 environment for Common Criteria is enabled.
- DDL REGISTRATION FLAG
- The DDL registration facility flag. It summarizes four settings for data definition control support:
- Data definition control
- Indicates whether DDL statements are validated by data definition control support.
- Application control
- Indicates whether the Db2 system is controlled by a set of closed applications whose application identifiers are identified in the application registration table. Closed applications require their Db2 objects to be managed solely through the plans or packages of the closed application that is registered in the application registration table.
- Full names required
- Indicates whether registered objects require fully-qualified names.
- Unregistered DDL action
- Indicates whether DDL that names an unregistered object is to be rejected, rejected if the current application is not registered, or accepted.
- INSTALL SYSADM
- One of two authorization IDs with SYSADM authority. SYSADM users can access to Db2 in all cases.
- DEFAULT USERID
- The authorization ID used if RACF is not available for batch access and USER= is not specified in the job statement.
- SYSADM ID 2
- One of two authorization IDs with SYSADM authority. SYSADM users can access to Db2 in all cases.
- SITE TYPE
- Shows whether this system is at a local site or a recovery site.
- LOCALSITE
- This is the site of the current system. Multiple image copies are made and are operational here. This is the default.
- RECOVERYSITE
- This an alternative site for recovery purposes.
- SYSOPER ID
- One of two authorization IDs with SYSOPR authority. SYSOPR users can access Db2 even if the Db2 catalog is unavailable.
- SYSOPER ID 2
- One of two authorization IDs with SYSOPR authority. SYSOPR users can access Db2 even if the Db2 catalog is unavailable.
- ENABLE Db2 AUTHORIZATION
- Shows whether Db2 performs authorization checking. When all authorization checking by Db2 is disabled, the GRANT statement is also disabled (granting every privilege to PUBLIC); this is not recommended.
- CACHE DYNAMIC SQL
- Indicates whether prepared dynamic use by eligible application processes.
- AUTH. CACHE SIZE
- The size of the authorization cache to use if no CACHESIZE is specified on the BIND PLAN subcommand. A value of 0 means authorization caching is not used.
- PACK AUTH CACHE
- The amount of storage that is allocated for caching authorization information for all packages on this Db2 member.
- DBADM CREATE VIEW
- Shows whether a Db2 administrator can create a view or alias for another user. Possible values are YES or NO. The default value is NO.
- EDM STATEMNT CACHE
- The size of the statement cache that can be used by the Environmental Descriptor Manager (EDM).
- ONL SYSPARM TYPE
- The type of Db2 system parameter that was changed by the last SET SYSPARM statement.
- ONL SYSPARM USER ID
- The user ID that made the last online change to Db2 system settings.
- ONL SYSPARM CORID
- The correlation ID of the online application that made the last change to Db2 system settings.
- ONL SYSPARM TIME
- Time of the last online change made to Db2 system settings.
- SECURITY ADMIN 1 TYPE
- Specifies whether the entry in the SECURITY ADMIN 1 field is an authorization ID or a role.
- SECURITY ADMIN 2 TYPE
- Specifies whether the entry in the SECURITY ADMIN 2 field is an authorization ID or a role.
- SECURITY TASKS
- Specifies whether Db2 security administrator duties are to be separated from system administrator duties for this subsystem. You must set the SEPARATE_SECURITY system parameter to YES in the evaluated configuration.
- REVOKE DEP. PRIVILEGES
- Specifies whether revoking a privilege from a user is to cause dependent privileges to be revoked. If dependent privileges are to be revoked, revoking a privilege from a user also revokes the privilege from anyone that the user has granted that privilege to.
- SECURITY ADMIN 1
- The first of two authorization IDs or roles that are assigned to have Db2 security administrator authority.
- SECURITY ADMIN 2
- The second of two authorization IDs or roles that are assigned to have Db2 security administrator authority.
Example for miscellaneous installation parameters
MISCELLANEOUS INSTALLATION PARAMETERS
COMMON CRITERIA ENVIRON : YES DDL REGISTRATION FLAG: X'30' INSTALL SYSADM : SYSADM1 DEFAULT USERID : IBMUSER
SYSADM ID 2 : SYSADM2 SITE TYPE : LOCAL SYSOPER ID : SYSOPR1 SYSOPER ID 2 : SYSOPR2
ENABLE DB2 AUTHORIZATION: YES CACHE DYNAMIC SQL : NO AUTH. CACHE SIZE: 01024
PACK AUTH CACHE : 0000000000 DBADM CREATE VIEW : YES EDM STMT CACHE : 0000005000 ONL SYSPARM TYPE : N/A
ONL SYSPARM CORID : ONL SYSPARM USER ID : ONL SYSPARM TIME: 08:26:40
SECURITY ADMIN 1 TYPE : AUTH ID SECURITY ADMIN 2 TYPE: AUTH ID SECURITY TASKS : SYSADM/SYSCTRL CANNOT GRANT/REVOKE
REVOKE DEP. PRIVILEGES : SPECIFIED IN REVOKE STATEMENT
SECURITY ADMIN 1 : SECADM
SECURITY ADMIN 2 : SECADM MISCELLANEOUS INSTALLATION PARAMETERS
COMMON CRITERIA ENVIRON : NO DDL REGISTRATION FLAG: X'30' INSTALL SYSADM : SYSADM DEFAULT USERID : IBMUSER
SYSADM ID 2 : SYSADM SITE TYPE : LOCAL SYSOPER ID : SYSOPR SYSOPER ID 2 : SYSOPR
ENABLE DB2 AUTHORIZATION: YES CACHE DYNAMIC SQL : NO AUTH. CACHE SIZE: 01024 HOP SITE AUTHORIZ.: YES
PACK AUTH CACHE : 0000032768 DBADM CREATE VIEW : NO EDM STMT CACHE : 0005120000 ONL SYSPARM TYPE : N/A
ONL SYSPARM CORID : ONL SYSPARM USER ID : ONL SYSPARM TIME: 08:26:40
Fields for DDF parameters
The IFCID106 DD has the following fields for DDF parameters:- FACILITY NAME
- The name of the DDF facility.
- RESYNCH.INTERVAL
- The number of minutes between resynchronization periods.
- TCP/IP VERIFIED
- Indicates whether Db2 accepts TCP/IP connection requests containing only a user ID.
- FACILITY START
- Indicates whether DDF is loaded, and if so, how it was started.
- DBAT STATUS
- Shows whether Db2 inactivates threads that have successfully committed or rolled back, and hold no cursors.
- TCP/IP KEEPALIVE
- Indicates whether the TCP/IP configuration KeepAlive value has been overwritten.
Example for DDF parameters
DISTRIBUTED DATA FACILITY PARAMETERS
FACILITY NAME: DDF RESYNCH.INTERVAL: 00002 TCP/IP VERIFIED: NO FACILITY START: AUTO
DBAT STATUS : INACTIVE TCP/IP KEEPALIVE: ENABLEFields for data sharing parameters
The IFCID106 DD has the following fields for data sharing parameters:- GROUP NAME
- The name of the Db2 data-sharing group. A value of N/A indicates that this Db2 is not part of a data-sharing group.
- MEMBER NAME
- The member name of this Db2. A value of N/A indicates that this Db2 is not part of a data-sharing group.
- DATA SHARING ENABLED
- Indicates whether data sharing is enabled.
- PAR.COORD
- Shows whether this Db2 member can coordinate parallel processing on other members of the group. A value of N/A indicates that this Db2 is not part of a data-sharing group.
- PAR.ASSIST
- Shows whether this Db2 member can assist a parallelism coordinator with parallel processing. A value of N/A indicates that this Db2 is not part of a data-sharing group.
Example for data sharing parameters
DATA SHARING PARAMETERS
GROUP NAME: DSNCAT MEMBER NAME: DB2A DATA SHARING ENABLED: NO PAR.COORD: NO
PAR.ASSIST: NO Fields for application programming defaults
The IFCID106 DD has the following fields for application programming defaults:- VERSION
- The version, release, and modification level.
- DEFAULT SUBSYSTEM
- The MVS subsystem name for Db2.
- EBCDIC SBCS CCSID
- The EBCDIC single-byte coded character set ID.
- DECIMAL POINT OPTION
- Indicates whether the decimal contains a comma (,) or a period (.).
- DEFAULT ENCODING SCHEME
- The default encoding scheme, which can be ASCII, EBCDIC, or UNICODE.
Example for application programming defaults
