Ensure that the SETROPTS PASSWORD(INTERVAL and PHRASEINT) values are set to a maximum of 365

ВысокийУровень 1Ручная проверкаibm-z

Описание

The SETROPTS INTERVAL parameter specifies the system default for the maximum number of days that each user's password and password phrase remain valid. The PHRASEINT parameter specifies the system default for the number of days that each user's password phrase remains valid and overrides the INTERVAL setting for password phrases.

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

Issue the following TSO command: SETROPTS LIST Review the command output in the PASSWORD PROCESSING OPTIONS: section. Look for the following message: PASSWORD CHANGE INTERVAL IS <nnn> DAYS. Verify the value is equal to or less than 254 days. Note: 254 is the maximum value allowed for INTERVAL. Look for the following message: PASSWORD PHRASE CHANGE INTERVAL IS <nnn> DAYS. Verify the value is equal to or less than 365 days. Note: The massage PASSWORD CHANGE INTERVAL IS IN EFFECT FOR PASSWORD PHRASES. may appear instead, indicating that the INTERVAL keyword ... (full steps: CIS section 1.1.1)

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

To modify the INTERVAL and PHRASEINT parameters use the RACF SETROPTS command: SETROPTS PASSWORD(INTERVAL(254) PHRASEINT(365))

Свойства

Операционные системы: Любая
Теги: ibm-zpassword-policy
Источник: CIS IBM z/OS with RACF Benchmark v1.0.0 - 1.1.1 Ensure that the SETROPTS PASSWORD(INTERVAL and PHRASEINT) values are set to a maximum of 365