changing db2<sid> password

[#1]

Hi,

Recently i just changed db2<sid> password in AIX using passwd command and also i changed the password in r/3 (tcode dbacockpit under database connection)

After that i looked at the etc/security/failedlogin file and i saw a lot of db2<sid> entries.

Can anyone enlighten me which part i have missed out or done wrongly?

Thanks a million

[Former Member · Accepted solution]

Hi,

Recently i just changed db2<sid> password in AIX using passwd command and also i changed the password in r/3 (tcode dbacockpit under database connection)

Please try using SAP Schema user (for example SAPSR3) in DBACOCKPIT database connection, instead of db2<sid> user.

Regards.

Rajesh Narkhede

[Former Member · Accepted solution]

Hi,

Thanks for your reply.

However, i don't understand, why should i change the user in dbacockpit?

[Former Member · Accepted solution]

Hi,

It is recommended to user database superuser in database connection (dbacockpit) NOT operating system user.

Refer the link below:

[http://help.sap.com/saphelp_nwpi71/helpdata/en/79/6272376d3bfa2be10000009b38f8cf/frameset.htm|http://help.sap.com/saphelp_nwpi71/helpdata/en/79/6272376d3bfa2be10000009b38f8cf/frameset.htm]

"If more authorizations are required for administrative actions, a second connection using the database administration user is used."

So chaning OS user password will not affect functionality of dbacockpit.

Regards.

Rajesh Narkhede

[Former Member · Accepted solution]

Hi,

Both SAP<SID> and DB2<SID> user are operating system user.

The functionality of DBACOCKPIT is not affected as far as i can tell.

The problem now is after i changed the password of db2<SID>, the AIX etc/security/failedlogin immediately record a lot of entries by db2<SID> which does not seem right...

[paul_power · Accepted solution]

Hi,

Changing the db2<sid> password will not require the

update of other users or any other change to reflect the changed

password. which would be needed if you change the passwords of

<sid>adm and sap<sid> (these would need to be updated via dscdb6up)

But if you change the db2<sid> password

it will not affect the running of the SAP instance as SAP

does not use this user to connect.

Do you see alot of entries in the db2diag.log of

Password validation for user db2<sid> failed with rc = -2146500507

validation for user db2<sid> failed with rc = -2146500507 in the

db2diag.log file means that the "Password does not belong with

specified user id" after DB2 SERVER password was changed for instance

owner.

It will not harm the system but some user or script is still using the

old password to connect and it generating this entry. It would be very difficult

to track down exactly what is tyring to connect as it is not an SAP application.

regards,

Paul

[Former Member · Accepted solution]

SAP connections would use the SAP<SID> id to connect to the database under normal circumstances. However, if the install was done with non-standard options, it is possible that SAP will use the db2<sid> id to connect to the database. The original team which installed our BW environment set the db6schema to db2<sid> which means that all sap connections come in using the db2<sid> id. Under such circumstances, you will need to be careful when changing the password for db2<sid>.

The steps would be to:

1. Change the password for the user at the OS level (as user db2<sid> )

2. Run dscdb6up as user <sid>adm to encrypt the new password in the dscdb6.conf file.

Our BW environment has been running with db2<sid> as the SAP schema name without any problems. This is how it was originally installed and its too much of a hassle to change it now. However, operationally, it does not cause us any challenges.

- Sameer

[paul_power · Accepted solution]

Hi,

dscdb6up doesnt update db2<sid>

you would get an error if you try to use it to update db2<sid>

dscdb6up db2<sid> <password>

should result in error:

unable to update user 'db2<sid>'

users found: '<sid>adm' and 'sap<sid>'

regards,

Paul

[Former Member · Accepted solution]

It will work if user db2<sid> is defined in the dscdb6.conf file (and /etc/passwd)

bqtadm 3> dscdb6up db2bqt
Enter new password for user "db2bqt": <somepassword>

Confirm password for user "db2bqt": <somepassword>


 Current OS password does not match password in password file.
 Please enter current OS password for user 'db2bqt': <somepassword>

password file '/usr/sap/BQT/SYS/global/dscdb6.conf' successfully written
OS user 'db2qt' successfully updated

If SAP is connecting using the user db2<bqt> then it will be present in the dscdb6.conf file (this can be verified by doing a cat on the dscdb6.conf file)

- Sameer

[Former Member]

Hi All,

Thanks a lot for the reply, i appreciate it.

However, i just want to clarify that we can leave SAP<SID> out of the picture as i do not intend to change its password.

The reason why DB2<SID> password have to be changed is because this user id is very powerful and our customer wants to hold it.

Secondly, i do notice that after changing DB2<SID> password, the operation is not affected, just that there are many logs in /etc/security/failedlogin. This concern me as our security audit is coming soon and the auditors will definitely hit us with this.

Paul, I have checked db2diag.log and indeed i see a lot of rc = -2146500507 entries. So how should i approach this?

Actually, what is the industry best practice for this?

I certainly don't think that i am the first one to change DB2<SID> password.

Thanks in advance!

[Former Member]

I agree with you that don't have to change the user in dba cockpit nor you have to add db2<sid> user to the conf file. Do you have Solution Manager which has the definition of this system? The connection could be coming from DB Connections in DB02 in Sol Man so you need to update the password there as well. Usually in the diaglog I think it gives you the source IP if the connection is failing. I am assuming you have set db2<sid> on the Unix side to lock after any number of attempts that is why the account is not locking out.

- Srikant