title: DB2 Federated Nicknames: Password Security
body: <p>I am working on an security analysis for an DB2 setup which uses federated nicknames.</p>
  
  <p>When setting up federated nicknames on DB2 a wrapper and user mappings must be created. For both a username and a password must be stored at the DB2.</p>
  
  <pre><code>CREATE SERVER V9SAMPLE TYPE DB2/UDB VERSION 9.1 WRAPPER DRDA 
    AUTHID "USERNAME" PASSWORD "PASSWORD" OPTIONS ( DBNAME 'SAMPLE' );
  CREATE USER MAPPING FOR USER SERVER V9SAMPLE OPTIONS 
  ( REMOTE_AUTHID 'USERNAME' REMOTE_PASSWORD 'PASSWORD' );
  </code></pre>
  
  <p>Can anybody tell me how DB2 stores this credentials internally and if there is any way to read AUTHID and PASSWORD from the database?
  I would exprect that they must be stored in plaintext as they must be send to another Server as login credentials. But that could open attack vectors as Mallory could recover the credentials.</p>
  
  <p>Are there any security measures that must be applied to protect the passwords saved for use with wrappers and user mappings?</p>