Re: AS400 user password

[Rob Berendt <rob@xxxxxxxxx>]

I know that Pentasafe has a program that will test all user 
profiles for trivial passwords.  Seems to be pretty thorough.

We had a problem with people just adding a digit to the end 
and had to activate some system values to prevent this.  

Folks, I suggest you look at all of the QPWD* system values and 
read the help on each one.  Some of the 40 column descriptions 
just don't define them well.  For the problem we had with digits 
we used QPWDPOSDIF.  To kill just about any dictionary word you 
could store all the vowels in QPWDLMTCHR. The list goes on... 





leif@leif.org on 06/11/2000 03:05:55 PM
Please respond to MIDRANGE-L@midrange.com@Internet
To:     MIDRANGE-L@midrange.com@Internet
cc:      
Fax to: 
Subject:        Re: AS400 user password

John,

you are, of course, correct. However, my comment was strictly in
response to the brute-force problem. The trivial passwords, common
word passwords, and adding digits to the end can all be defeated
with a dictionary attack, but at least you have to mount an attack
rather than just guessing. The problem is often made worse by
requiring passwords to be changed too often (say once a month).
If you use a *good* password (e.g. S1P7@MDJ) you should be
allowed to keep for a long time.

----- Original Message -----
From: John Earl <johnearl@400security.com>
To: <MIDRANGE-L@midrange.com>
Sent: Sunday, June 11, 2000 1:55 PM
Subject: Re: AS400 user password


> Leif,
>
> Leif Svalgaard wrote:
>
> >
> > BTW: if you apply any or all of the rules for passwords
> > controlled by the QPWD* system values, you make
> > the decryption easier as you diminish the key space.
> > A long password is not more secure than a short
> > password.
>
> I know that you qualified your comments here, but it bears emphasizing....
>
> For the purposes of a brute force attack, a long password may not be more
secure
> than a short password, but the QPWD* values assist in preventing other
kinds of
> attacks... specifically those that are aided by trivial or common
passwords.
> Setting rules that prevent password recycling, the use of dictionary words,
or
> the awful habit of appending a digit to the end of the last password, will
help
> keep passwords from being easily guessed by just anyone who happens by.
>
> jte
>
>
> --
> John Earl                               johnearl@400security.com
> The PowerTech Group                     206-575-0711
> PowerLock Network Security              www.400security.com
> --
>
>
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> | To unsubscribe from this list send email to
MIDRANGE-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator:
david@midrange.com
> +---
>

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---