Re: change password API

["Phil Hall" <hallp@xxxxxxxx>]

> Well, I had done something of this nature myself, but I never
> felt it was that secure because it didn't use encryption.

If I'm repeating something already mentioned, forgive me:

There are two API's, from V3R7 that allow you to send encrypted
passwords form one machine to another. QSYRUPWD (retrieve encrypted
password) and QSYSUPWD (set encrypted password). These two API's can
(and are meant to) be used together to sync passwords between AS/400s

QSYRUPWD retrieves the DES5 encrypted version of the password from the
user password table. This value is already encrypted.

QSYSUPWD sets a users password (using an encrypted value retrieved by
QSYRUPWD) in the table to the supplied value. At no point is the
password decrypted in to the plain text form.

Passing this encrypted value over the net work should be fairly safe (as
safe as passing any encrypted data can be) I my self would probably
double encrypt it with another public domain routine (such as Blowfish)
just to obscure the data even more.

One thing however, is to ensure that the multiple systems that you are
trying to sync passwords between are using the same password limiting
system values, to ensure that the passwords can be sync'ed.

hope this helps,

--phil

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---