Password Basics – Password Selection

By Rich Loeber,

There is nothing quite so basic in the security arena as a password. The combination of user profile and password, if properly used and administered, can go a long way to establishing sound system security on your IBM i system.

To start with, configuration and selection of your password is important. All those terrible computer hacker movies do have something going for them when they have people guessing passwords. Too many people select a password that is just too easy to guess. (I was actually at a client recently where the password for QSECOFR was set to ‘PASSWORD’!)

There is a good way to deal with this problem on your IBM i. There are two system values that can help you to enforce the selection of passwords that are harder to guess. These are:

  • QPWDLMTCHR – “Limit characters in password”
  • QPWDRQDDGT – “Require digit in password”

By changing the QPWDLMTCHR setting to the value “AEIOU”, you will disallow all passwords that contain vowels. Setting the QPWDRQDDGT value to ‘1′ will require that at least one character position of the password will have to contain a numeric character. Between these two settings, you can almost guarantee passwords that are much harder to guess.

Along these same lines, there are three other system values that you should consider:

  • QPWDMINLEN – “Minimum password length”
  • QPWDRQDDIF – “Duplicate password control”
  • QPWDLMTREP – “Limit repeating characters in password”

I normally recommend that the minimum password length be set to 5 and 6 is even better. The duplicate password control limits how frequently your users can reuse old favorites. Using the maximum value of ‘1′ effectively prevents recycling of favorite passwords by disallowing a password that has been used sometime during the previous 32 password changes. Also, limiting repeating characters will also provide a little more control. I recommend using the value of ‘2′ to simply disallow contiguous repeating characters.

Remember, the whole idea is to eliminate passwords that are easy to guess but not make is so difficult that people never remember their own passwords. There is a fine line here between protecting your system and keeping your users happy and productive.

Comments are closed.