Re: New Password rules at VRM610

On 23/04/2008, at 11:53 PM, Ed Fishel wrote:

>
> Perhaps you were looking for documentation in the wrong place. For  
> example
> one of the notes for the description of QPWDLMTCHR in the V6R1  
> information
> center and Chapter 3 of the V6R1 Security Reference manual is this:  
> "If the
> QPWDRULES system value specifies any value other than *PWDSYSVAL, this
> system value cannot be changed and its value will be ignored when new
> passwords are checked to see if they are formed correctly".

I was looking in the Information Centre reference for QPWDRULES. I  
did not see any new option that mapped to the facility provided by  
QPWDLMTCHR. The QPWDRULES documentation listed the QPWD* system  
values that will be ignored so I saw no reason to to read the  
QPWDLMTCHR documentation (although I should have done).

>
> You are probably already aware that QPWDLMTCHR is only enforced when
> QPWDLVL is set to 0 or 1. The most popular use of QPWDLMTCHR is  
> probably to
> prevent the use of vowels in a password. It can also be used to  
> prevent the
> use of the letter Q (so users can't have passwords like Q123456 and  
> then
> just use 123456 as their password).  QPWDLMTCHR can also be used to  
> prevent
> the use of the ten digits.

Actually I wasn't aware of that--at least if someone had asked me  
does QPWDLMTCHR take effect at password levels 2 or 3 I would have  
said "Don't see why not".

However, if I want to continue using password level 0 or 1 AND change  
to QPWDRULES it seems I cannot retain the behaviour of QPWDLMTCHR and  
that is not at all clear from the documentation.

>
> I can say that our decision to not include the QPWDLMTCHR function  
> in the
> new QPWDLMTCHR system value was not an oversight. You are free to  
> use the
> old rules if you wish, so in that sense the old function was not  
> removed.
> If you use the new QPWDRULES system value then by specifying the  
> minimum
> number of digits, letters, and special characters you should be  
> able to
> prevent a dictionary attack. The *LTRLMTAJC value can also be used to
> prevent a dictionary attack by not allowing any two letters to be  
> next to
> each other.

Ok, but if I want to use the new rules because it is simply easier to  
keep them in one place and I choose to remain with password level 0  
or 1 you've just broken my password rules.

My point is that changing to use QPWDRULES is an administrator  
decision that does not require any approval because it (mostly) does  
not affect end-user behaviour--especially if the new rules simply  
implement the old ones just in a single place for the administrator's  
convenience.

Changing QPWDLVL is not an administrator decision because it has a  
significant effect on how users sign-on--not least of which is the  
case-sensitivity issue.

Now however, if I need to retain QPWDLMTCHR you have FORCED me to  
continue with the individual system values or write an exit program  
to support this behaviour.

>
> It is my hope that most people that use QPWDRULES will be able to stop
> using a password validation program. These programs are risky  
> because they
> are passed both the old and new password of the user. The risk is that
> someone could change the program to save the passwords in a file or  
> some
> other object.

I gathered that from the sort of things that have been added to  
QPWDRULES. It mostly makes my own, 13 year-old, exit program  
unnecessary.


Regards,
Simon Coulter.
--------------------------------------------------------------------
    FlyByNight Software         OS/400, i5/OS Technical Specialists

    http://www.flybynight.com.au/
    Phone: +61 2 6657 8251   Mobile: +61 0411 091 400        /"\
    Fax:   +61 2 6657 8251                                   \ /
                                                              X
                  ASCII Ribbon campaign against HTML E-Mail  / \
--------------------------------------------------------------------



_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.