Ensure that the SETROPTS PASSWORD(INTERVAL and PHRASEINT) values are set to a maximum of 365

AltaNivel 1Revisión manualibm-z

Descripción

The SETROPTS INTERVAL parameter specifies the system default for the maximum number of days that each user's password and password phrase remain valid. The PHRASEINT parameter specifies the system default for the number of days that each user's password phrase remains valid and overrides the INTERVAL setting for password phrases.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Issue the following TSO command: SETROPTS LIST Review the command output in the PASSWORD PROCESSING OPTIONS: section. Look for the following message: PASSWORD CHANGE INTERVAL IS <nnn> DAYS. Verify the value is equal to or less than 254 days. Note: 254 is the maximum value allowed for INTERVAL. Look for the following message: PASSWORD PHRASE CHANGE INTERVAL IS <nnn> DAYS. Verify the value is equal to or less than 365 days. Note: The massage PASSWORD CHANGE INTERVAL IS IN EFFECT FOR PASSWORD PHRASES. may appear instead, indicating that the INTERVAL keyword ... (full steps: CIS section 1.1.1)

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

To modify the INTERVAL and PHRASEINT parameters use the RACF SETROPTS command: SETROPTS PASSWORD(INTERVAL(254) PHRASEINT(365))

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: ibm-zpassword-policy
Referencia: CIS IBM z/OS with RACF Benchmark v1.0.0 - 1.1.1 Ensure that the SETROPTS PASSWORD(INTERVAL and PHRASEINT) values are set to a maximum of 365