Db2 connecting to a db via alias and storing user name and password

The words "securely", "exposing", "outside" and "database" do not belong together.

Under no circumstance should you ever expose a SQL server to the internet. It's a very bad idea.

So your question really should be: How do we give access to our SQL server to remote locations?

The answer: VPN. The remote users should establish a VPN connection to your network. From there you can give them the appropriate access to the database.

I believe you want the following

• AUTHENTICATION = CLIENT
• TRUST_ALLCLNTS = NO
• TRUST_CLNTAUTH = SERVER

As you have changed above, the AUTHENTICATION=CLIENT, will force the client to authenticate. (Which can still use the OS as noted above.)

TRUST_CLNTAUTH = SERVER will cause the client to send the user id and password to the server for authentication when they are provided in the connect statement. This still does not force the client to require the user name and password as it can get them from the OS.

This is because DB2 will assume TRUST_ALLCLNTS as YES by default. This causes the server to assume all clients can be trusted and allow them to check against their respective OS's. So from what I know, to force the client to require a user name and password with the connect statement requires TRUST_ALLCLNTS to be set to NO. This will cause the server to not trust them and force them to send the user id and password to the server to authenticate against it.