Securing system access levels

You can control the level of security by setting the password system values.

For example, if your company has recently added a system that runs highly confidential financial applications, you need to reassess your company's system security policy. In general, your company follows a moderately strict security policy. So, rather than completely rewriting the policy, you decide to restrict sign-on access to the new finance system by tightening the password rules.

To secure entry into the finance system, you must complete the following tasks:

  • Set a policy that states that passwords must not be trivial and must not be shared.
  • Set system values to help you enforce the new policy. (See Table 1.)

In addition, you might also want to provide users with this information:

  • A list of the criteria for passwords.
  • Examples of passwords that are and are not valid. (See Table 2.)
  • Suggestions for how to think of a good password.

The following table lists the recommended password system value settings to implement your new password requirements. (These values can be changed depending on how strict you want to control sign-on access.)

Table 1. System value settings
Name in IBM® Navigator for i Recommended value Name in character-based interface
 
Password expiration 60 days QPWDEXPITV
Restrict consecutive digits Yes QPWDLMTAJC
Password level 3 (See note 1.) QPWDLVL
Maximum password length 8 characters QPWDMAXLEN
Minimum password length 6 characters QPWDMINLEN
Require a new character in each position Yes QPWDPOSDIF
Require at least one digit Yes QPWDRQDDGT
Password reuse cycle 10 passwords QPWDRQDDIF
Password validation program None (See note 2.) QPWDVLDPGM
Restrict repeating characters Characters may not be used consecutively QPWDLMTREP
Restricted characters A,E,I,O,U,@,#, and $ QPWDLMTCHR
Notes:
  1. You might not be able to use password level 3 if you need to connect to or from a system running OS/400® V5R1, or earlier, or to or from a system that does not support long passwords.
  2. To change this system value, you must use the character-based interface. It is not available in IBM Navigator for i. Open a character-based interface and type the following command:
    CHGSYSVAL VALUE(QPWDVLDPGM) VALUE('*NONE')

The following table provides examples of good and bad passwords.

Table 2. Example passwords
Password Details
JohnDoe Bad. Do not use a name. Also, no digits are used.
112000 Bad. Do not use a date that can be identified with you.
aaaxyz Bad. Uses more than 2 consecutive characters and uses a character that is not allowed (a). Also, no digit is used.
cm2s0j Good. Meets all the criteria for a good password.
c0mptr Good. Meets all the criteria for a good password.
Mfc1RB Good. Meets all the criteria for a good password. The strategy for this password uses the first letter of each word in a sentence, 'My favorite color is Royal Blue.' It also replaces the vowel with a number and uses a combination of upper and lower case characters.

By completing these steps, you have tightened sign-on access to the finance system by changing the password system values. You can alter the values for each of the password system values to meet the security level for your company. This example has provided one way that the password system values can work together to produce a moderately strict environment.