Security considerations to control Db2 subsystems

This section describes the necessary authorization that permits SA z/OS® to control and to act on Db2® subsystems appropriately.

The SA z/OS provided Db2 best practices policy contains Db2 related commands to be issued as MVS command and a utility INGDB2. For more information about the INGDB2 utility, see the INGDB2 command in IBM Z® System Automation Operator's Commands.

Granting SA z/OS to the Db2 SYSCTRL authority level enables SA z/OS to control the dedicated Db2 subsystem. The SYSCTRL authority is designed for administering a system that contains sensitive data. With the SYSCTRL authority, you have nearly complete control of the Db2 subsystem. However, you cannot access user data directly unless you are explicitly granted the privileges to do so.

If the Db2 is secured by RACF®, use the following statements to permit SA z/OS to control the Db2 subsystem.
  1. Permit SA z/OS to control a dedicated Db2 subsystem.
    PERMIT <db2-subsystem>.SYSCTRL DSNADM CLASS(DSNADM) ID(AUTWRK01..) ACC(READ)
  2. Permit SA z/OS to control all Db2 subsystems on a system.
    PERMIT *.SYSCTRL DSNADM CLASS(DSNADM) ID(AUTWRK01..) ACC(READ)

If the Db2 security is located within the Db2 subsystem itself, then grant all SA z/OS work operators AUTWRK01 – AUTWRKnn to the Db2 SYSCTRL authority level.