← Back to IBM z/OS ACF2 Security Technical Implementation Guide

V-223508

CAT II (Medium)

ACF2 PSWD GSO record value must be set to prohibit password reuse for a minimum of five generations or more.

Rule ID

SV-223508r1001119_rule

STIG

IBM z/OS ACF2 Security Technical Implementation Guide

Version

V9R8

CCIs

CCI-004061 CCI-004065

Discussion

Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. If the information system or application allows the user to consecutively reuse their password when that password has exceeded its defined lifetime, the end result is a password that is not changed as per policy requirements.

Check Content

From an ACF command screen enter:
SET CONTROL(GSO)
LIST PSWD

If "PSWDXHIST" is not specified, this is a finding.

If "PSWDXHIST#" is set to "5" or greater, this is not a finding.

Fix Text

Configure Password option "PSWXHST" is coded and "PSWXHST#" is "5" or greater.