as400 password change history
Hi i would like to ask how to display the system value for Password Change History?
Thanks,
/chris
Software/Hardware used:
Software/Hardware used:
ASKED:
April 16, 2009 1:25 AM
UPDATED:
April 20, 2009 5:11 AM
Answer Wiki:
Chris,
I am assuming you mean Duplicate Password Control
dspsysval qpwdrqddif
This controls how often a user can repeat the use of a password.
Bill Poulin
Hi Bill,
this is what im looking for base on my auditor.
i need to change the current value to 6
Thank you so much and also to those who give their input.
To see all answers submitted to the Answer Wiki: View Answer History.
The only system value I can think of that in any way fits this query is the QPWDRQDDIF sysval, which sets how many different passwords must be used before they can be re-used.
DSPSYSVAL (or WRKSYSVAL) QPWDRQDDIF…
If this is not what you are after then you will need to provide more information on what it is you are wanting to do…..
The i Series does not store passwords in a way the users can retrieve and de-crypt them. It keeps the list internally somewhere. Maybe someone knows how to hack into this data. I suspect some sort of hash total is used, which is not reversable according to the experts I heard.
If you really want to keep a history, you can write an command validation program to capture the data at the time the use changes their password.
The system does a great job of this automatically.
I strongly recommend against trying to work around this security feature.
Set the system value QPWDEXPITV *SEC Password expiration interval to the desired number of days for all profiles, change all profiles expint to *SYSVAL and you will force a regular pwd change. The industry standard is pretty much 90 for normal users and 30-45 for power users. You could also turn on user auditing for Security dump and query your audit journal on a regular basis and track pwd changes.
BTW, i5OS finally went to a UNIX style encrypted pwd file, so several of the third party security packages allow you to see pwds and to check for pwds that are too ‘simple’. You usually must be signed on as QSECOFR to use these functions.