RE: password policy and system rules

Or taped to the bottom of the keyboard.

Paul Nelson
Cell 708-670-6978
Office 708-425-4198
nelsonp@xxxxxxxxxxxxx


-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Michael Ryan
Sent: Wednesday, March 07, 2007 9:03 PM
To: Midrange Systems Technical Discussion
Subject: Re: password policy and system rules


Or they'll end up putting their password on a sticky note and sticking it on
their terminal...

On 3/7/07, Lapeyre, Francis <FLAPEYRE@xxxxxxxx> wrote:

That policy seems unnecessarily restrictive.

Only a 4 character minimum? Ours is 8.

I don't agree with case sensitive passwords and requiring all kinds of 
special characters in it. That only frustrates users at password 
change time and they will end up using something easy to remember. 
Requiring a numeral is OK.

Francis Lapeyre
IS Dept. Programmer/Analyst
Stewart Enterprises, Inc.
E-mail: flapeyre@xxxxxxxx <mailto:flapeyre@xxxxxxxx>

________________________________

From: midrange-l-bounces@xxxxxxxxxxxx on behalf of Mike Cunningham
Sent: Wed 3/7/2007 4:07 PM
To: Midrange Systems Technical Discussion
Subject: password policy and system rules



We are getting ready to update our campus security policy which has a 
section on password rules.  There is a "discussion" brewing that is 
coming down to Active Directory rules and OS/500 rules for setting 
passwords. The Active Directory crowd wants to have the rules set in 
ways that Microsoft can enforce but that does not match the rules that 
OS/400 can enforce (short of writing our own exit program and enforce 
any rules we want). The rules being proposed



                Must be at least 4 characters

                Must be changed every 180 days

                Can't change your password more than once a day

                Must contain at least 3 of the following 4

                                One lower case alpha character (a-z)

                                One upper case alpha character (A-Z)

                                One numeric character (0-9)

                                One special character
(!@#$%^&*()=+{}[]|\:;"'<>,.?/) < <mailto:!@#$%^&*()=+{}[]|\:;> >,.?/)>



OS/400 (at V5R3) can't handle the last rule (unless we write our own 
routine). I have three questions. First, to those of you on V5R4 are 
there any additional rules that OS/400 has for checking passwords? 
Second, have you turned on long passwords or are you still using 10? 
Third, what are your companies password policies?



--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, 
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives at 
http://archive.midrange.com/midrange-l.




--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, 
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives at 
http://archive.midrange.com/midrange-l.