RE: password policy and system rules

Martin's policy happens to be our policy also (however, on the
development box, password change interval is 180 days; production is 90
days). Network passwords can be different, although I keep mine
synchronized for convenience. If a user forgets and disables the profile
after 3 tries, they call the help desk, which verifies the last 4 digits
of their SSN and calls a program that enables the profile, sets the
password to a default value, and forces a change at the next sign-on (it
validates against the HR files and will not allow a terminated employee
to get their profile reset). The HD techs do not have access to
CHGUSRPRF directly; they have to go through the program. Terminated
users have their profiles disabled automatically the morning after their
last day on the job, even if their supervisor forgets to tell the Help
Desk about it (they have to tell HR immediately, of course).

Francis Lapeyre
IS Dept. Programmer/Analyst
Stewart Enterprises, Inc.
E-mail: flapeyre@xxxxxxxx 

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Martin Rowe
Sent: Thursday, March 8, 2007 3:54 AM
To: Midrange Systems Technical Discussion
Subject: Re: password policy and system rules

On 08/03/07, Lukas Beeler <l.beeler@xxxxxxxxxxx> wrote:

We use both Active Directory and i5/OS at V5R4 with long passwords.

We have the following password policy:

* Minimum 8 chars
* Different case for at least 1 char
* At least one Number
* Password must be changed once a year

Unfortunately we still have a few '98 clients, so can't use long
passwords yet (there's an issue with NetServer support). Our policy
changed due to SOX, so now we have

* Minimum eight chars (QPWDMINLEN=8)
* At least one numeric (QPWDRQDDGT=1)
* No consecutive repeated characters (QPWDLMTREP=2)
* Can't match last 24 passwords (QPWDRQDDIF=2)
* Must be changed every 90 days.

The last requirement is done through a combination of setting
PWDEXPITV on the profile for users that regularly use 5250 sessions,
and a daily routine that emails less frequent users when their
password is within a fortnight of expiring. Our helpdesk gets informs
of any profiles that haven't been changed within the allotted time,
and the user gets 'reminded' to get compliant.

Our i5 is the master system for users on our network, pushing changes
to Active Directory, so many users are on the system that never use
5250 sessions. They use Access for Web to change their password -
which still works fine on the old Tomcat 3.2.4 server, even though the
web based 5250 sessions don't.

I usually use the Unix utility "pwgen" to generate passwords.

They look like this:

azae0Quo Pahde8ie thei8Nee Ei3yae3a vieth5Bi ohpohL4z aed0Shaz

Aib5cai2

Easy enough to remember.

I installed http://aixpdslib.seas.ucla.edu/packages/pwgen.html in PASE
for just this purpose.

Regards, Martin