Db2

Db2

Where DBAs and data experts come together to stop operating and start innovating. Connect, share, and shape the AI era with us.


#Data


#Data
#Databases
#Operatingsystems
#Db2
#Databasesolutions
 View Only

  • 1.  Native Encryption - parameter setting

    Posted 03/31/21 12:39 PM

    Hi,

    creating a database with the encrypt Option will result in following db cfg:

    Encryption Library for Backup         (ENCRLIB) = libdb2encr.so

     

    Setting this option for an un-encrypted

    db2 "update db cfg for test using encrlib libdb2encr.so"

    will not work and will return

    => SQL5099 Path does not exist

     

    Specifying it including the path will work but will will return an unexpected result as well. Isuing

    db2 "update db cfg for test    using encrlib /home/db2inst2/sqllib/lib64/libdb2encr.so"

    will result in following db cfg
    Encryption Library for Backup         (ENCRLIB) = /opt/ibm/db2/V11.1/lib64/libdb2encr.so.1

    Why is the path resolved?

    This could result in problems for fixpack and version upgrades.

    Will this path automatically patched in the future during those upgrades?

     

    best regards

    Michael Tiefenbacher


    #Db2
    #Db2EarlyAccessProgram(EAP)Forum


  • 2.  RE: Native Encryption - parameter setting

    Posted 03/31/21 12:40 PM

    Hi Michael,

     

    Sorry for a very late answer to this one. I did not know why the behaviour is the way it is and had to do some investigation. 

     

    As I currently understand it, the behaviour is working as intended. Only DB2 can set the short value "libdb2encr.so" and it does so during create database.  If a customer changes the value, they must set it to a fully qualified path and cannot set it back to the short name. 

     

    The rationale for this is that (apparently) it is to allow us to tell if it has been changed after create database. We want to do full validation on the encryption library at the time it is set and prevent the possibility of redirecting it later with LD_LIBRARY_PATH to pick up a different version of the library.

     

    I could not find out if anything was done (other than discussion) about the issue you point out  for future updates/upgrades so it is quite possibly still an open issue which has been allowed to stay because no one has altered this parameter in the same manner as you describe.

     

    Hope this helps,

    Paul.




  • 3.  RE: Native Encryption - parameter setting

    Posted 03/31/21 12:40 PM

    Hi Paul,

     

    thanks for your Investigation.

    I think there should be a note in thje upgrade documenattion that this Parameter Needs to be adjusted manually.

    For the future I wish this is done automatically by the upgrade process. At the time of the upgrade DB2 should know the right path and that the new Directory is the right one and secure.

     

    best regards

    Michael Tiefenbacher


    Original Message


Related Content