Re: New Password rules at VRM610

On 22/04/2008, at 12:23 PM, Leif Svalgaard wrote:
>>  QPWDLMTCHR allows you to force omission of certain characters from
>>  passwords (typically vowels) but I cannot see a similar function in
>>  the new rules.
>
> And for a very good reason as it is a silly facility to have. Every  
> time you
> remove symbols from key, the key-space gets smaller, thus weakening
> the encryption. I guess IBM finally wizened up.

Hasn't really answered my question though has it? Yes it can reduce  
the key-space but that decision should be up to the system/security  
administrator. Removing vowels was a good way of removing easily  
guess-able passwords. It also helps make a dictionary attack a bit  
harder. As we all know 10-character passwords are not terribly secure  
regardless of the key-space. With the new 128-character pass-phrases  
that becomes less of an issue.

Anyway, that's not my immediate concern. It is simply that setting  
QPDWRULES to *PWDSYSVAL (which is the default) allows QPWDLMTCHR to  
be in effect just at is is on pre-VRM610 systems. Once you set  
QPWDRULES to anything else there appears to be no way to implement  
the QPWDLMTCHR rule except via an exit program. Therefore, regardless  
of what you think of the feature, a feature has been removed and  
that's not usually done without documentation explicitly saying so. I  
cannot find such documentation hence my question.

Regards,
Simon Coulter.
--------------------------------------------------------------------
    FlyByNight Software         OS/400, i5/OS Technical Specialists

    http://www.flybynight.com.au/
    Phone: +61 2 6657 8251   Mobile: +61 0411 091 400        /"\
    Fax:   +61 2 6657 8251                                   \ /
                                                              X
                  ASCII Ribbon campaign against HTML E-Mail  / \
--------------------------------------------------------------------



_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.