IBM i
TMA-IBM-I-5.1.2.18
Set Password Expiration Interval
HighLevel 2Manual reviewibm-i
Description
Determines the maximum number of days a password is valid from 1 to 366 or *NOMAX. Note that service accounts may have their PWDEXPITV set to *NOMAX on the user profile whereas standard user profiles should be set to *SYSVAL. This helps to prevent access to unauthorized persons by promoting longer passphrases that are more difficult to crack.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Run DSPSYSVAL SYSVAL(QPWDEXPITV) (or WRKSYSVAL QPWDEXPITV) and verify the value is "365". Remediate with: CHGSYSVAL SYSVAL(QPWDEXPITV) VALUE('365')
How it is fixed
Fix method: Guidance or infrastructure patch
To establish the recommended configuration, set the following system value to "365": QPWDEXPITV CHGSYSVAL SYSVAL(QPWDEXPITV) VALUE('365')
Properties
- Operating systems
- Any
- Tags
- ibm-ipassword-policy
- Reference
- CIS IBM i V7R5M0 Benchmark v2.1.0 - 5.1.2.18 Set Password Expiration Interval