RE: password policy and system rules

["Lukas Beeler" <l.beeler@xxxxxxxxxxx>]

We use both Active Directory and i5/OS at V5R4 with long passwords.

We have the following password policy:

* Minimum 8 chars
* Different case for at least 1 char
* At least one Number
* Password must be changed once a year

I usually use the Unix utility "pwgen" to generate passwords.

They look like this:

azae0Quo Pahde8ie thei8Nee Ei3yae3a vieth5Bi ohpohL4z aed0Shaz Aib5cai2

Easy enough to remember.

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Mike Cunningham
Sent: Wednesday, March 07, 2007 11:07 PM
To: Midrange Systems Technical Discussion
Subject: password policy and system rules

We are getting ready to update our campus security policy which has a
section on password rules.  There is a "discussion" brewing that is
coming down to Active Directory rules and OS/500 rules for setting
passwords. The Active Directory crowd wants to have the rules set in
ways that Microsoft can enforce but that does not match the rules that
OS/400 can enforce (short of writing our own exit program and enforce
any rules we want). The rules being proposed 

 

                Must be at least 4 characters 

                Must be changed every 180 days

                Can't change your password more than once a day

                Must contain at least 3 of the following 4 

                                One lower case alpha character (a-z)

                                One upper case alpha character (A-Z)

                                One numeric character (0-9)

                                One special character
(!@#$%^&*()=+{}[]|\:;"'<>,.?/) <mailto:!@#$%^&*()=+{}[]|\:;"'<>,.?/)> 

                

OS/400 (at V5R3) can't handle the last rule (unless we write our own
routine). I have three questions. First, to those of you on V5R4 are
there any additional rules that OS/400 has for checking passwords?
Second, have you turned on long passwords or are you still using 10?
Third, what are your companies password policies?