Feature Article

Checkup on your User Profiles for 2014 and Beyond

By Dan Riehl - SecureMyi.com

IBM i provides some great administration tools to help you manage the user profiles on your system. While there are scads of commands that can be used in user profile management, I have selected I few of my favorites that you may want to add to your security management 'bag of tricks'.

Finding User Profiles with Matching Passwords

The CL command ANZDFTPWD(Analyze default passwords) is a tool that allows you to easily generate a list of users who have passwords that exactly match the UserID name. These matching Passwords are called 'Default Passwords'. In addition, the command optionally allows you specify an action to be taken against those offending profiles. You can specify that the profiles are to be disabled(i.e. the user cannot sign on), or that you want to set the password to an expired state(i.e. the user must assign a new password next time they sign on.)

Here is the report generated by the ANZDFTPWD command.

             User profiles with default passwords	           Page    1
5770SS1 V7R1M0  100423	                        OPENSYS   01/03/14  09:51:19

Action taken against profiles  . . . . . . :   *NONE
User
Profile         STATUS         PWDEXP     Text
SDCXCADA        *ENABLED        *NO       Willy Singer
SDCXCCAA        *DISABLED       *NO       Garret Butcher
SDCXCCAF        *ENABLED        *NO       Charly Boller
SDCXCCMG        *DISABLED       *NO       Fark S. Barr
SDCYCCTH        *ENABLED        *NO       Mike K. Adams
SSDCYCDR        *DISABLED       *NO       N. K. Griffen
QSYSOPR         *ENABLED        *NO       System Operator	

When you run this command on your system, you may see similar results to this. Several user profiles have matching passwords, and many are enabled. One really nasty entry in the list is the one for QSYSOPR. The QSYSOPR profile has a matching password, and is enabled. Anyone trying to break into your system would most likely try to log-in with the default IBM supplied profiles like QSECOFR, QSYSOPR, etc.

I cannot stress the importance of making sure that no entries ever appear on this list. User profiles should never have matching passwords. If they do, your system security can easily be compromised.

Checking up on SST/DST UserID and Passwords

Prior to IBM i 6.1, if you wanted to check for Default Passwords for Service Tools UserIDs, and general Service Tools User Settings, you had to Start System Service Tools(STRSST), and provide a valid service tools UserID and Password. As of IBM i 6.1, IBM has provided the Control Language command Display System Service Tools Users(DSPSSTUSR), which allows you to view the settings of your Service Tools Users.

Read More about some Favorite Tools