Ensure that the SETROPTS PASSWORD(REVOKE) value is set to a maximum of 6

HochStufe 1Manuelle Prüfungibm-z

Beschreibung

SETROPTS PASSWORD(REVOKE(<nnn>)) enables you to specify how many consecutive incorrect password and password phrase attempts RACF permits before it revokes the user ID on the next attempt. Note: If you specify REVOKE, INITSTATS must be in effect. The overall goal is it to make it difficult for an attacker to guess a password by trying it against an account, while allowing a user the ability to correct a mistakenly entered password in a reasonable way.

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

Issue the following TSO command: SETROPTS LIST Review the command output in the ATTRIBUTES = section. Verify that INITSTATS appears. Review the command output in the PASSWORD PROCESSING OPTIONS: section. Look for the following message: AFTER <nnn> CONSECUTIVE UNSUCCESSFUL PASSWORD ATTEMPTS, A USERID WILL BE REVOKED. Verify the value is equal to or less than 6 attempts.

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

To modify the REVOKE parameter use the RACF SETROPTS command: SETROPTS PASSWORD(REVOKE(6)) If you specify REVOKE, INITSTATS must be in effect. To enable INITSTATS use the RACF SETROPTS command: SETROPTS INITSTATS

Eigenschaften

Betriebssysteme: Beliebig
Tags: ibm-zpassword-policy
Referenz: CIS IBM z/OS with RACF Benchmark v1.0.0 - 1.1.5 Ensure that the SETROPTS PASSWORD(REVOKE) value is set to a maximum of 6