Feature Article

Live Security Related Webcasts and Training for IBM i

February Events

Reduce the Cost and Effort of IBM i Auditing
Live Webcast - Presented by Powertech - For UK Audience
Thursday, February 27 1400 UK London
More Information and Register to Attend

March Events

Coffee with Carol: I want my Privacy!
with Carol Woodbury
Live Webcast - Presented by Skyview Partners
Wednesday, March 5 10:00am CDT
More Information and Register to Attend

Enforcing the Integrity of Your IBM i Data And Server
Live Webcast - Presented by Powertech
Thursday, March 6 1:00pm CT
More Information and Register to Attend

Live Hands-On - IBM i Concepts and Control Language Programming
with Dan Riehl
Training Workshop - March 3-7
Dan Riehl presents this 5-Day Live Online Hands-on Workshop.
More Information and Register to Attend

April Events

Coffee with Carol: Cloud Security Review
with Carol Woodbury
Live Webcast - Presented by Skyview Partners
Wednesday, April 2 10:00am CDT
More Information and Register to Attend

Live Hands-On - Expanded Security Workshop for IBM i
with Dan Riehl
Training Workshop - April 8-11
Dan Riehl presents this 4-Day Live Online Hands-on Workshop.
More Information and Register to Attend

May Events

May 4-7 - COMMON - A User Group
2014 Annual Conference and Exposition - Orlando, FL
More Information and Register to Attend

Security Shorts - Using QPWDRQDDIF with QPWDCHGBLK

                              to Enforce Stronger Password Protections

By Dan Riehl

The System Value QPWDRQDDIF has been available for many years as a means of forcing users to choose new or previously 'unused' passwords when changing their password. The number you specify for the System Value determines 'How many previous passwords are checked' to ensure that the new password has not been used, or not been used recently.

The number specified in the System Value corresponds to the number of previous passwords that are checked.

Value  Specified Number of previous passwords checked
0      0 – No Previous passwords are checked, Can be the same
1      32
2      24
3      18
4      12
5      10
6      8
7      6
8      4

I always wonder at "technology" like that exhibited in this System Value. Why not just allow me to specify the number of previous passwords to check, instead of a number that corresponds to a number of previous passwords to check?

If I want to check the previous 6 passwords, I specify the number 7 for the System Value QPWDRQDDIF.   Who thought this up?

What if I want to check for the previous 5 passwords? It can't be done. hmmm.

In IBM i 6.1, IBM provided an additional system value that allows you to more strictly enforce the 'password difference' rule. The new system value is QPWDCHGBLK(Block Password Changes), which allows you to specify a number of hours in which a newly changed password cannot be changed again. A password change is temporarily blocked.

The shipped value is *NONE, which means that a newly changed password can be changed again immediately. That is also the behavior we have prior to 6.1. And that is where our users have taken advantage of the lack of a password change blocking mechanism.

Prior to 6.1, users can repeatedly change their password until they have exhausted your Password Difference System Value. Their goal, and the ultimate result is that they have been able to reset their password back to the same password that they have used for years. It's so much easier to remember, Ya Know?

The QPWDCHGBLK System Value allows you to enforce a timer which says 'You cannot change your password again for n number of hours'; where n is a number from 1 to 99. So, once a user has successfully changed their password, they are prohibited from changing their password again for the number of hours that you specify in the System Value.

For added security, a security administrator can always change a user's password using the CHGUSRPRF(Change User Profile) command. On another note; the password change block is not in effect when the user's password has been 'Set to Expired' using CHGUSRPRF.

The Password Change Block System Value can be overridden at the User Profile level using the PWDCHGBLK parameter of the CRTUSRPRF and CHGUSRPRF commands as shown here:

CRT/CHGUSRPRF USRPRF(MYUSER) PWDCHGBLK(*SYSVAL,   or a number 1-99)