Ensure that the SETROPTS PASSWORD(REVOKE) value is set to a maximum of 6

HighLevel 1Manual reviewibm-z

Description

SETROPTS PASSWORD(REVOKE(<nnn>)) enables you to specify how many consecutive incorrect password and password phrase attempts RACF permits before it revokes the user ID on the next attempt. Note: If you specify REVOKE, INITSTATS must be in effect. The overall goal is it to make it difficult for an attacker to guess a password by trying it against an account, while allowing a user the ability to correct a mistakenly entered password in a reasonable way.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Issue the following TSO command: SETROPTS LIST Review the command output in the ATTRIBUTES = section. Verify that INITSTATS appears. Review the command output in the PASSWORD PROCESSING OPTIONS: section. Look for the following message: AFTER <nnn> CONSECUTIVE UNSUCCESSFUL PASSWORD ATTEMPTS, A USERID WILL BE REVOKED. Verify the value is equal to or less than 6 attempts.

How it is fixed

Fix method: Guidance or infrastructure patch

To modify the REVOKE parameter use the RACF SETROPTS command: SETROPTS PASSWORD(REVOKE(6)) If you specify REVOKE, INITSTATS must be in effect. To enable INITSTATS use the RACF SETROPTS command: SETROPTS INITSTATS

Properties

Operating systems: Any
Tags: ibm-zpassword-policy
Reference: CIS IBM z/OS with RACF Benchmark v1.0.0 - 1.1.5 Ensure that the SETROPTS PASSWORD(REVOKE) value is set to a maximum of 6