Check: RACF-ES-000810
IBM z/OS RACF STIG:
RACF-ES-000810
(in versions v9 r3 through v8 r1)
Title
The IBM RACF PASSWORD(HISTORY) SETROPTS value must be set to five or more. (Cat II impact)
Discussion
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. HISTORY specifies the number of previous passwords that RACF saves for each USERID and compares with an intended new password. If there is a match with one of the previous passwords, or with the current password, RACF rejects the intended new password.
Check Content
From the ISPF Command Shell enter: SETRopts List If the PASSWORD(HISTORY) value is set properly then the message x GENERATIONS OF PREVIOUS PASSWORDS BEING MAINTAINED, where x is a minimum of "5", this is not a finding.
Fix Text
Configure the PASSWORD(HISTORY) SETROPTS value is set to a minimum of "5". This specifies the number of previous passwords that RACF saves for each USERID and compares with an intended new password. If there is a match with one of the previous passwords, or with the current password, RACF rejects the intended new password. Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below: The RACF Command SETR LIST will show the status of RACF Controls including PASSWORD HISTORY. Setting the password history to 10 generations is activated with the command SETR PASSWORD(HISTORY(10)).
Additional Identifiers
Rule ID: SV-223728r998354_rule
Vulnerability ID: V-223728
Group Title: SRG-OS-000077-GPOS-00045
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-004061 |
For password-based authentication, verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a). |
Controls
| Number | Title |
|---|---|
| No controls are assigned to this check |