Ensure that the SETROPTS PASSWORD(INTERVAL and PHRASEINT) values are set to a maximum of 365

TinggiLevel 1Tinjauan manualibm-z

Deskripsi

The SETROPTS INTERVAL parameter specifies the system default for the maximum number of days that each user's password and password phrase remain valid. The PHRASEINT parameter specifies the system default for the number of days that each user's password phrase remains valid and overrides the INTERVAL setting for password phrases.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Issue the following TSO command: SETROPTS LIST Review the command output in the PASSWORD PROCESSING OPTIONS: section. Look for the following message: PASSWORD CHANGE INTERVAL IS <nnn> DAYS. Verify the value is equal to or less than 254 days. Note: 254 is the maximum value allowed for INTERVAL. Look for the following message: PASSWORD PHRASE CHANGE INTERVAL IS <nnn> DAYS. Verify the value is equal to or less than 365 days. Note: The massage PASSWORD CHANGE INTERVAL IS IN EFFECT FOR PASSWORD PHRASES. may appear instead, indicating that the INTERVAL keyword ... (full steps: CIS section 1.1.1)

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

To modify the INTERVAL and PHRASEINT parameters use the RACF SETROPTS command: SETROPTS PASSWORD(INTERVAL(254) PHRASEINT(365))

Properti

Sistem operasi: Apa saja
Tag: ibm-zpassword-policy
Referensi: CIS IBM z/OS with RACF Benchmark v1.0.0 - 1.1.1 Ensure that the SETROPTS PASSWORD(INTERVAL and PHRASEINT) values are set to a maximum of 365