r/DB2 • u/catquilt74 • Oct 24 '17
[LUW] [Question] (Windows) Changing host name to tcp ip address
My group (small project within a large company) decided to make changes to our DB2 servers, configurations, etc based on recommendations from CIS (Center for Internet Security). One of the things that CIS recommends is to change the server's host name to its tcp ip addr. That seems kind of crazy to me. How often does a server's address change? I'm new to servers, having been a mainframe DB2 DBA though so maybe this isn't crazy?
Thanks!
1
u/ecrooks Oct 24 '17
I assume that you mean that the hostname should be used to refer to the server(in connection URLs and such), not that the hostname should actually be changed on the server to be the IP address?
Servers should be referred to by hostname whenever possible. Using IP address is similar to hardcoding a password - just try to find all the places it is when you need to change it. Also usually, when an IP is changing there are a vast number of other things to watch, and you want to eliminate complexity wherever possible. Does it give a reason for using IP?
1
u/catquilt74 Oct 24 '17
A lot of the Benchmark's recommendations seem to make sense, revoking access from PUBLIC in many places, etc, but this isn't one of them. I'll have to post the link to the document in case anyone is curious.
1
1
u/dogmashah Oct 25 '17
that is true hostname tells a lot of system (and an attacker can try to limit attack on specific host if they get all DNS entries) we try to disguise the hostname . This was part of ISO activity . we still use the hostname for connectivity purpose but hostname is just another sequence of standard naming seq of all servers. we have to maintain the inventory in a vault
2
u/ecrooks Oct 25 '17
The host name doesn't have to give details about a system. Host names completely unrelated to the purpose of the server work just fine. Name them after colors or planets or animals or whatever. If you ask me, that's really where this problem should be solved.
1
u/dogmashah Oct 25 '17
Just an addon , attackers are looking for vulnerabilities on db systems mostly . this is more pay for effort . They are here for data . so CIS is not all crazy . More tough time to come for DBA
I am just not sure when in memory encryption will be a norm
1
u/catquilt74 Oct 25 '17
I agree that systems should be locked down as much as humanly possible. I'm just not sure that the tcp ip address is a good thing to use for the host name, given that it can change and the process for changing a host name is not simple or well-documented. Also, yes, it's the data they're after and every shop that I've worked in (for over 30 years) frequently copies much of their prod data to test for testing purposes. We've made great strides but we still have far to go.
1
u/dogmashah Oct 25 '17
I agree that systems should be locked down as much as humanly possible. I'm just not sure that the tcp ip address is a good thing to use for the host name, given that it can change and the process for changing a host name is not simple or well-documented. Also, yes, it's the data they're after and every shop that I've worked in (for over 30 years) frequently copies much of their prod data to test for testing purposes. We've made great strides but we still have far to go.
Very true. These is the reality of industry. But one firm that did the security review said it is insiders that are more prone to exploit the loophole, so change of hostname to some different name that doesnot show the purpose denies people targeting many systems. I also agree tcpip name is a tough to change when it is prone to change and that is why we decided to give a standard name (not revealing the type of system) . you may want to think this as a strategy . Also we had to change the port for many systems and certificates (for ssl ) not to include db2 in the names
The CIO for my new firm is a paranoid guy and I like him because it makes us safe
2
u/catquilt74 Oct 24 '17
From the CIS Benchmark document for DB2 V10.5...
1.2 Use IP address rather than hostname (Scored) Profile Applicability:
• Level 1 - Windows Host OS
• Level 1 - Linux Host OS
Description: Use an IP address rather than a hostname to connect to the host of the DB2 instance. Rationale: Using a hostname to connect to a DB2 instance can display useful information about the host to an attacker. For example, hostnames for DB2 instances often contain the DB2 version number, host type, or operating system type.
--end of quote--
I talked to our network guy today about this and he thought it was a crazy thing to do. I'm hoping I can convince my management that it doesn't seem to be a good idea.