Ensure that the SETROPTS PASSWORD(INTERVAL and PHRASEINT) values are set to a maximum of 365

HochStufe 1Manuelle Prüfungibm-z

Beschreibung

The SETROPTS INTERVAL parameter specifies the system default for the maximum number of days that each user's password and password phrase remain valid. The PHRASEINT parameter specifies the system default for the number of days that each user's password phrase remains valid and overrides the INTERVAL setting for password phrases.

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

Issue the following TSO command: SETROPTS LIST Review the command output in the PASSWORD PROCESSING OPTIONS: section. Look for the following message: PASSWORD CHANGE INTERVAL IS <nnn> DAYS. Verify the value is equal to or less than 254 days. Note: 254 is the maximum value allowed for INTERVAL. Look for the following message: PASSWORD PHRASE CHANGE INTERVAL IS <nnn> DAYS. Verify the value is equal to or less than 365 days. Note: The massage PASSWORD CHANGE INTERVAL IS IN EFFECT FOR PASSWORD PHRASES. may appear instead, indicating that the INTERVAL keyword ... (full steps: CIS section 1.1.1)

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

To modify the INTERVAL and PHRASEINT parameters use the RACF SETROPTS command: SETROPTS PASSWORD(INTERVAL(254) PHRASEINT(365))

Eigenschaften

Betriebssysteme: Beliebig
Tags: ibm-zpassword-policy
Referenz: CIS IBM z/OS with RACF Benchmark v1.0.0 - 1.1.1 Ensure that the SETROPTS PASSWORD(INTERVAL and PHRASEINT) values are set to a maximum of 365