Re: iSeries passwords

[Vern Hamberg <vhamberg@xxxxxxxxxxxxxxxxxxxxxxxxx>]

Hi, Adam

There has been some confusion here, I think. I do not believe that anything 
is stored in an unencrypted form. I may be wrong, so someone please correct 
this.

The issue about passwords in the clear began with Al's post on the exit 
program that is specified in the system value, QPWDVLDPGM. One bit of 
confusion here is, this is NOT an exit point registered with WRKREGINF, 
it's a program called by the CHGPWD command or the QSYCHGPW API, if 
specified in the system value. The problem is, nonetheless, that the user 
had to enter his/her old password and the new one, in order to change it. 
These 2 values are in the clear in the parameters to the password 
validation program.

Then questions came up about passwords in the clear from remote clients, 
which generally obfuscated the whole discussion as originally posited, if I 
read these things correctly.

We really have fun here, don't we? I love tangents.  ;-)

So, is it the case that 128-character passwords are not encrypted? I 
sincerely hope not.

It would appear that, starting in V5R2, you can make it impossible to 
change password-related system values. This is cool - not even QSECOFR can 
change them. So a good (note, "good"), well-controlled security plan can 
allow you to have a validation program, I think. It'd mean, at the extreme, 
that this program is owned by QSECOFR, no one but QSECOFR has *ALLOBJ 
authorization, nothing that adopts from QSECOFR can get a command line, and 
only one person in the world knows the QSECOFR password - or something like 
that. That may not even be enough to make it almost impossible to change 
the program specified in the system value to something that is malware.

Vern

At 12:26 PM 11/19/2003 +1100, you wrote:
> Hi,
>
> Thanks to Rob and everyone else that responded. And Rob, yes you are
> correct, the issue is forcing a mix of upper and lower case, not just
> accepting it. Reading the IBM documentation it seems to be that the
> underlying validation engine (or whatever it's called) will treat passwords
> as upper case only regardless of what you do with a validation program. In
> any case, the need to change the system value so passowrds are no longer
> stored in an encrypted format is something we contemplate with a shudder.
>
> Our answer to the client is that even if possible, the risks far outweigh
> the benefits.
>
> Thanks
>
> Adam Driver
> Technical Consultant
> Kaz Technology Services
> Level 7
> 66 Wentworth Ave
> Sydney NSW 2010
> Australia
> Phone: +61 2 9844 0386
> Fax: +61 2 9844 0333
>
> A division of Kaz Group Limited - visit our website at www.kaz.com.au
>
>
>
> date: Tue, 18 Nov 2003 08:12:39 -0500
> from: rob@xxxxxxxxx
> subject: Re: iSeries passwords
>
> WRKSYSVAL QPWDVLDPGM
> http://publib.boulder.ibm.com/iseries/v5r2/ic2924/info/rzakz/rzakzpassword11bridge.htm
>
>
> - OR -
>
> The password validation exit program
> http://publib.boulder.ibm.com/iseries/v5r2/ic2924/info/apis/xsyvlphr.htm
>
> Rob Berendt
> --
> "They that can give up essential liberty to obtain a little temporary
> safety deserve neither liberty nor safety."
> Benjamin Franklin
>
>
>
>
> Adam.Driver@xxxxxxxxxxxxx
> Sent by: midrange-l-bounces+rob=dekko.com@xxxxxxxxxxxx
> 11/17/2003 10:12 PM
> Please respond to
> Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
>
>
> To
> midrange-l@xxxxxxxxxxxx
> cc
>
> Subject
> iSeries passwords
>
>
>
>
>
>
> Hi Everyone,
>
> We have a customer that wants us to force a mixture of upper and lower
> case
> and special characters in user passwords. Has anyone ever heard of a way
> of
> doing this? Exit programs perhaps, or a utility anyone may have written?
>
> Thanks
>
> Adam Driver
> Technical Consultant
> Kaz Technology Services
> Level 7
> 66 Wentworth Ave
> Sydney NSW 2010
> Australia
> Phone: +61 2 9844 0386
> Fax: +61 2 9844 0333
>
> A division of Kaz Group Limited - visit our website at www.kaz.com.au
>
>
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.