TMA-IBM-I-4.6
Default Passwords
Opis
A profile has a default password when the profile's password matches the user profile name. A change was made in 7.5 so that the default for the password on CRTUSRPRF is *NONE. When you create new user profiles, consider assigning a unique, non-trivial password instead of using a default password. Default passwords provide an opportunity for someone to enter your system anonymously. Default passwords are easy to guess. Additionally, accounts with default passwords are often used for shared (non-unique) accounts.
Kako se proverava
Metod provere: Ručni pregled
Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.
On a command line, type STRSQL and press Enter Enter the following SQL statement and press Enter. SELECT ALL USER_NAME, STATUS, DFTPWD, PWDEXP FROM QSYS2/USER_INFO T01 WHERE DFTPWD = 'YES'
Kako se ispravlja
Metod ispravke: Smernica ili zakrpa infrastrukture
To establish the recommended configuration, change the password of all user profiles with default passwords to a non-trivial password and set the password to expire. CHGUSRPRF USRPRF(<xxxxxx>) PASSWORD(<xxxxxx>) PWDEXP(*YES) Additionally, the command ANZDFTPWD ACTION (*DISABLE) should be added to a job schedule entry to periodically scan for and *DISABLE any profiles with *DEFAULT passwords, and system value QPWDRULES should contain the parameters *ALLCRTCHG and *LMTPRFNAME to prevent the creation of profiles with *DEFAULT passwords.
Svojstva
- Operativni sistemi
- Bilo koji
- Oznake
- ibm-ipassword-policy
- Referenca
- CIS IBM i V7R5M0 Benchmark v2.1.0 - 4.6 Default Passwords