Ensure that the SETROPTS PASSWORD(REVOKE) value is set to a maximum of 6

ÉlevéeNiveau 1Revue manuelleibm-z

Description

SETROPTS PASSWORD(REVOKE(<nnn>)) enables you to specify how many consecutive incorrect password and password phrase attempts RACF permits before it revokes the user ID on the next attempt. Note: If you specify REVOKE, INITSTATS must be in effect. The overall goal is it to make it difficult for an attacker to guess a password by trying it against an account, while allowing a user the ability to correct a mistakenly entered password in a reasonable way.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Issue the following TSO command: SETROPTS LIST Review the command output in the ATTRIBUTES = section. Verify that INITSTATS appears. Review the command output in the PASSWORD PROCESSING OPTIONS: section. Look for the following message: AFTER <nnn> CONSECUTIVE UNSUCCESSFUL PASSWORD ATTEMPTS, A USERID WILL BE REVOKED. Verify the value is equal to or less than 6 attempts.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

To modify the REVOKE parameter use the RACF SETROPTS command: SETROPTS PASSWORD(REVOKE(6)) If you specify REVOKE, INITSTATS must be in effect. To enable INITSTATS use the RACF SETROPTS command: SETROPTS INITSTATS

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: ibm-zpassword-policy
Référence: CIS IBM z/OS with RACF Benchmark v1.0.0 - 1.1.5 Ensure that the SETROPTS PASSWORD(REVOKE) value is set to a maximum of 6