The IBM RACF PASSWORD(HISTORY) SETROPTS value must be set to five or more.
An XCCDF Rule
Description
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. HISTORY specifies the number of previous passwords that RACF saves for each USERID and compares with an intended new password. If there is a match with one of the previous passwords, or with the current password, RACF rejects the intended new password.
- ID
- SV-223728r998354_rule
- Version
- RACF-ES-000810
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure the PASSWORD(HISTORY) SETROPTS value is set to a minimum of "5". This specifies the number of previous passwords that RACF saves for each USERID and compares with an intended new password. If there is a match with one of the previous passwords, or with the current password, RACF rejects the intended new password.
Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:
The RACF Command SETR LIST will show the status of RACF Controls including PASSWORD HISTORY.
Setting the password history to 10 generations is activated with the command SETR PASSWORD(HISTORY(10)).