Ensure that the SETROPTS PASSWORD(INTERVAL and PHRASEINT) values are set to a maximum of 365

ÉlevéeNiveau 1Revue manuelleibm-z

Description

The SETROPTS INTERVAL parameter specifies the system default for the maximum number of days that each user's password and password phrase remain valid. The PHRASEINT parameter specifies the system default for the number of days that each user's password phrase remains valid and overrides the INTERVAL setting for password phrases.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Issue the following TSO command: SETROPTS LIST Review the command output in the PASSWORD PROCESSING OPTIONS: section. Look for the following message: PASSWORD CHANGE INTERVAL IS <nnn> DAYS. Verify the value is equal to or less than 254 days. Note: 254 is the maximum value allowed for INTERVAL. Look for the following message: PASSWORD PHRASE CHANGE INTERVAL IS <nnn> DAYS. Verify the value is equal to or less than 365 days. Note: The massage PASSWORD CHANGE INTERVAL IS IN EFFECT FOR PASSWORD PHRASES. may appear instead, indicating that the INTERVAL keyword ... (full steps: CIS section 1.1.1)

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

To modify the INTERVAL and PHRASEINT parameters use the RACF SETROPTS command: SETROPTS PASSWORD(INTERVAL(254) PHRASEINT(365))

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: ibm-zpassword-policy
Référence: CIS IBM z/OS with RACF Benchmark v1.0.0 - 1.1.1 Ensure that the SETROPTS PASSWORD(INTERVAL and PHRASEINT) values are set to a maximum of 365