Re: password policy and system rules

On 08/03/07, Lukas Beeler <l.beeler@xxxxxxxxxxx> wrote:

We use both Active Directory and i5/OS at V5R4 with long passwords.

We have the following password policy:

* Minimum 8 chars
* Different case for at least 1 char
* At least one Number
* Password must be changed once a year

Unfortunately we still have a few '98 clients, so can't use long
passwords yet (there's an issue with NetServer support). Our policy
changed due to SOX, so now we have

* Minimum eight chars (QPWDMINLEN=8)
* At least one numeric (QPWDRQDDGT=1)
* No consecutive repeated characters (QPWDLMTREP=2)
* Can't match last 24 passwords (QPWDRQDDIF=2)
* Must be changed every 90 days.

The last requirement is done through a combination of setting
PWDEXPITV on the profile for users that regularly use 5250 sessions,
and a daily routine that emails less frequent users when their
password is within a fortnight of expiring. Our helpdesk gets informs
of any profiles that haven't been changed within the allotted time,
and the user gets 'reminded' to get compliant.

Our i5 is the master system for users on our network, pushing changes
to Active Directory, so many users are on the system that never use
5250 sessions. They use Access for Web to change their password -
which still works fine on the old Tomcat 3.2.4 server, even though the
web based 5250 sessions don't.

I usually use the Unix utility "pwgen" to generate passwords.

They look like this:

azae0Quo Pahde8ie thei8Nee Ei3yae3a vieth5Bi ohpohL4z aed0Shaz Aib5cai2

Easy enough to remember.

I installed http://aixpdslib.seas.ucla.edu/packages/pwgen.html in PASE
for just this purpose.

Regards, Martin