TMA-IBM-I-4.6
Default Passwords
Beschreibung
A profile has a default password when the profile's password matches the user profile name. A change was made in 7.5 so that the default for the password on CRTUSRPRF is *NONE. When you create new user profiles, consider assigning a unique, non-trivial password instead of using a default password. Default passwords provide an opportunity for someone to enter your system anonymously. Default passwords are easy to guess. Additionally, accounts with default passwords are often used for shared (non-unique) accounts.
So wird geprüft
Prüfmethode: Manuelle Prüfung
Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.
On a command line, type STRSQL and press Enter Enter the following SQL statement and press Enter. SELECT ALL USER_NAME, STATUS, DFTPWD, PWDEXP FROM QSYS2/USER_INFO T01 WHERE DFTPWD = 'YES'
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
To establish the recommended configuration, change the password of all user profiles with default passwords to a non-trivial password and set the password to expire. CHGUSRPRF USRPRF(<xxxxxx>) PASSWORD(<xxxxxx>) PWDEXP(*YES) Additionally, the command ANZDFTPWD ACTION (*DISABLE) should be added to a job schedule entry to periodically scan for and *DISABLE any profiles with *DEFAULT passwords, and system value QPWDRULES should contain the parameters *ALLCRTCHG and *LMTPRFNAME to prevent the creation of profiles with *DEFAULT passwords.
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- ibm-ipassword-policy
- Referenz
- CIS IBM i V7R5M0 Benchmark v2.1.0 - 4.6 Default Passwords