Ensure that the SETROPTS PASSWORD(REVOKE) value is set to a maximum of 6

TinggiLevel 1Tinjauan manualibm-z

Deskripsi

SETROPTS PASSWORD(REVOKE(<nnn>)) enables you to specify how many consecutive incorrect password and password phrase attempts RACF permits before it revokes the user ID on the next attempt. Note: If you specify REVOKE, INITSTATS must be in effect. The overall goal is it to make it difficult for an attacker to guess a password by trying it against an account, while allowing a user the ability to correct a mistakenly entered password in a reasonable way.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Issue the following TSO command: SETROPTS LIST Review the command output in the ATTRIBUTES = section. Verify that INITSTATS appears. Review the command output in the PASSWORD PROCESSING OPTIONS: section. Look for the following message: AFTER <nnn> CONSECUTIVE UNSUCCESSFUL PASSWORD ATTEMPTS, A USERID WILL BE REVOKED. Verify the value is equal to or less than 6 attempts.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

To modify the REVOKE parameter use the RACF SETROPTS command: SETROPTS PASSWORD(REVOKE(6)) If you specify REVOKE, INITSTATS must be in effect. To enable INITSTATS use the RACF SETROPTS command: SETROPTS INITSTATS

Properti

Sistem operasi: Apa saja
Tag: ibm-zpassword-policy
Referensi: CIS IBM z/OS with RACF Benchmark v1.0.0 - 1.1.5 Ensure that the SETROPTS PASSWORD(REVOKE) value is set to a maximum of 6