21
Tue, May
3 New Articles

Moving Your IBM i to a Higher Password Level

IBM i (OS/400, i5/OS)
Typography
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

Safeguarding and protecting passwords on IBM i demands moving to a higher level. Carol discusses the benefits and provides guidance on changing QPWDLVL to increase password strength.

There's heightened focus across the IBM i community to improve the power of passwords. That's music to my ears! Here are the considerations you'll have to make when moving the system to a higher password level.

The system value QPWDLVL controls the password formats stored as well as the length and character set available for users' passwords. Changes to this system value will take effect with the next IPL. I'll discuss this system value in two sets: Password levels 0 and 1 and password levels 2 and 3.

Password levels 0 and 1 define that a user's password will have a maximum length of 10 characters and can consist only of uppercase A–Z, numerals 0–9, and special characters #, @, $ and _. The problem with these two levels is the restricted character set. The small number of possibilities of password combinations means that passwords are relatively easy to guess and can certainly be brute-force attacked in a short period of time. The difference between password levels 0 and 1 is in the format of the passwords stored. At password level 1, one of the formats is a very weakly encrypted version that's used when users are connecting to the NetServer. This version is rather easy to decrypt, so it presents a vulnerability to the IBM i. The good news, however, is that the only connections using this password are those coming from computers running Windows 95, 98, or ME or Windows 2000 Server and connecting to the NetServer. These days, it's rare that organizations still have computers using these operating systems. Or if they do, they are not used to connect to the NetServer; therefore, for the vast majority of organizations, they will, at the very least, be able to move to password level 1 (that is, set QPWDLVL to '1') and experience absolutely no issues. The benefit of moving to password level 1 is that the weakly encrypted Microsoft password is no longer stored and, therefore, no longer presents a vulnerability to the system.

If you do nothing else, consider moving to password level 1.

What I would really like you to consider, however, is moving to an even higher level, with password level 3 being your ultimate goal. Here are the benefits of moving to password level 2 or 3.

  • Moving the system to one of these levels enables passwords that can be up to 128 characters and can contain any valueuppercase and lowercase letters, numerals, punctuation, spaces, and any special characters. This increases the password character-set tremendously and reduces the chances of having the password guessed (assuming appropriate composition rules are applied) and increases the time of a brute-force attack.
  • If you need to, you can keep the maximum length of a password to be 10, but even doing that, because of the greatly increased character-set that the password can contain, you've made it much harder for people to guess a password.
  • Password level 2 or 3 also makes the QPWDRULES system value more usable. When using QPWDRULES, you put all of your rules in this one system value (min length, max length, etc. rather than using the individual QPWDMINLEN, for example), but then you can add the value of *REQANY3 - require any 3, so now users have the requirement of using three of the following four: an uppercase, lowercase, digit, or special character in their password.
  • Password level 2 or 3 usually makes it easier for the IBM i passwords to have the same requirements as the network password.
  • Users will not have to change their password right away unless you force them to. They can use their existing password even after the system moves to password level 2 or 3.

As I've stated previously, an IPL is required to make the new password level take effect. Here's what changes on the IPL:

  • The password field on the sign-on screen is different. If you've modified the sign-on display that ships with the systems, you'll now have to modify the DDS (the display specifications) that includes the 128-character password field. See Figure 1.

021916WoodburyFig1

Figure 1: Here’s the sign-on display after IPLing to QPWDLVL 2 or 3. Notice the increased length of the Password field.

  • Prompts for the CRTUSRPRF and CHGUSRPRF commands are changed to allow input of passwords that are 128 chars long.  See Figure 2.

021916WoodburyFig2

Figure 2: This is how the User password parameter will appear in both the Create and Change User Profile commands at password level 2 or 3.

There are some considerations that you'll want to make prior to making the move to a higher password level. Here's what to look out for and also what has the potential to break:

  • If you have any utilities that reset a user's password (perhaps used by your Help Desk, for example), you'll want to modify those to allow for the longer password.
  • Connections: In general, all connections should work. By this I mean connections that are made from another server to your IBM i using ODBC, JDBC, DDM, FTP, etc. These connections are typically established with a script that contains the password of the profile being used to connect to IBM i. These connections will work unless the password used is hard-coded to be in mixed case. Let me explain further. At password levels 0 and 1, passwords are stored encrypted in two formatsone all uppercase and one all lowercaseto make it easier to make the move to password level 2 or 3. (As I've discussed earlier, password level 0 has an additional formata weakly encrypted password used to connect to the NetServer via old clients.) When the system moves to 2 or 3, passwords are no longer "folded" to be all uppercase or lowercase when the password is entered. At levels 2 and 3, it's what you see is what you get. So when the system is at password level 2 or 3 and a connection passes in a mixed case password, the system thinks that it's truly a mixed case password and compares it to what's stored. If the profile's password hasn't been changed since the IPL, what is still stored is a version of the password in all uppercase and another one in all lowercase letters. In that situation, a connection passing in a mixed case password will fail. But if the password contains either all uppercase or all lowercase letters, the connection will be established with no issue.
  • End users: The biggest issue with this move is typically educating the end users. When users enter a mixed case password into an IBM i sign-on screen out of either habit (because that's how they enter the password for the network) or ignorance (thinking they're really using a mixed case password), their signon will fail because the system will no longer fold the password to all uppercase and all lowercase at password level 2 or 3. The system will take the password "as is" and, because there's no mixed case password stored, the user's sign-on will fail. So you have to train the users to not use a mixed case password until they change their password for the first time. Truly, this is the biggest issue for the customers that I've seen make the move to level 2 or 3 from level 0 or 1. Typically, they make everyone change their password right away so the training amounts to making sure everyone enters their current password in all lowercase (or all uppercase), and then users can type in a mixed-case password from then on. Admittedly, it can be a mess that first day after the system is IPLed (because all users are affected at the same time), but after that, it's usually not an issue.
  • The IBM Security Reference manual advises that all of the systems in your network should be at the same password level. But as I've seen countless times at various clients, it's not an issue to have systems at different password levels.

The ultimate goal should be to get to password level 3 because password level 2 starts storing the old (and weak) Microsoft password again. You might be tempted to jump right to password level 3, but if something's not quite right and you have to move back down to level 0 or 1, it's going to be difficult. If you IPL directly back to 0 or 1, you have to re-assign a password to every user who needs to sign on or make a connection because the password that's stored at level 3 or will work only at level 2 or 3, not 0 or 1. So backing off of level 3 is really a two-step process: first go to level 2, then go to level 0 or 1. The better approach is to go to level 2 and hang there until you know all of your connections are working. Once you know all your connections work, then IPL to level 3. If you have to back down from level 2 to 0 or 1, there's a password stored that will work for each user at those levels (assuming that it's a max length of 10 and doesn't use special characters that aren't supported at level 0 or 1).

Final Thoughts

QPWDLVL 3 is where you want to be because, at that level, the only password that's stored is the one that works at password levels 2 and 3. You'll just want to get there in steps.

Carol Woodbury

 

Carol Woodbury is IBM i Security SME and Senior Advisor to Kisco Systems, a firm focused on providing IBM i security solutions. Carol has over 30 years’ experience with IBM i security, starting her career as Security Team Leader and Chief Engineering Manager for iSeries Security at IBM in Rochester, MN. Since leaving IBM, she has co-founded two companies: SkyView Partners and DXR Security. Her practical experience and her intimate knowledge of the system combine for a unique viewpoint and experience level that cannot be matched.

Carol is known worldwide as an author and award-winning speaker on security technology, specializing in IBM i security topics. She has written seven books on IBM i security, including her two current books, IBM i Security Administration and Compliance, 3rd Edition and Mastering IBM i Security, A Modern, Step-by-Step Approach. Carol has been named an IBM Champion since 2018 and holds her CISSP and CRISC security certifications.


MC Press books written by Carol Woodbury available now on the MC Press Bookstore.

IBM i Security Administration and Compliance: Third Edition
Don't miss the newest edition by the industry’s #1 IBM i security expert.
List Price $71.95

Now On Sale

Mastering IBM i Security Mastering IBM i Security
Get the must-have guide by the industry’s #1 security authority.
List Price $49.95

Now On Sale

BLOG COMMENTS POWERED BY DISQUS

LATEST COMMENTS

Support MC Press Online

$0.00 Raised:
$

Book Reviews

Resource Center

  • SB Profound WC 5536 Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application. You can find Part 1 here. In Part 2 of our free Node.js Webinar Series, Brian May teaches you the different tooling options available for writing code, debugging, and using Git for version control. Brian will briefly discuss the different tools available, and demonstrate his preferred setup for Node development on IBM i or any platform. Attend this webinar to learn:

  • SB Profound WP 5539More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.

  • SB HelpSystems ROBOT Generic IBM announced the E1080 servers using the latest Power10 processor in September 2021. The most powerful processor from IBM to date, Power10 is designed to handle the demands of doing business in today’s high-tech atmosphere, including running cloud applications, supporting big data, and managing AI workloads. But what does Power10 mean for your data center? In this recorded webinar, IBMers Dan Sundt and Dylan Boday join IBM Power Champion Tom Huntington for a discussion on why Power10 technology is the right strategic investment if you run IBM i, AIX, or Linux. In this action-packed hour, Tom will share trends from the IBM i and AIX user communities while Dan and Dylan dive into the tech specs for key hardware, including:

  • Magic MarkTRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now!  Request Now.

  • SB HelpSystems ROBOT GenericForms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.

  • SB HelpSystems ROBOT GenericIT security is a top priority for businesses around the world, but most IBM i pros don’t know where to begin—and most cybersecurity experts don’t know IBM i. In this session, Robin Tatam explores the business impact of lax IBM i security, the top vulnerabilities putting IBM i at risk, and the steps you can take to protect your organization. If you’re looking to avoid unexpected downtime or corrupted data, you don’t want to miss this session.

  • SB HelpSystems ROBOT GenericCan you trust all of your users all of the time? A typical end user receives 16 malicious emails each month, but only 17 percent of these phishing campaigns are reported to IT. Once an attack is underway, most organizations won’t discover the breach until six months later. A staggering amount of damage can occur in that time. Despite these risks, 93 percent of organizations are leaving their IBM i systems vulnerable to cybercrime. In this on-demand webinar, IBM i security experts Robin Tatam and Sandi Moore will reveal:

  • FORTRA Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:

  • FORTRAManaging messages on your IBM i can be more than a full-time job if you have to do it manually. Messages need a response and resources must be monitored—often over multiple systems and across platforms. How can you be sure you won’t miss important system events? Automate your message center with the Robot Message Management Solution. Key features include:

  • FORTRAThe thought of printing, distributing, and storing iSeries reports manually may reduce you to tears. Paper and labor costs associated with report generation can spiral out of control. Mountains of paper threaten to swamp your files. Robot automates report bursting, distribution, bundling, and archiving, and offers secure, selective online report viewing. Manage your reports with the Robot Report Management Solution. Key features include:

  • FORTRAFor over 30 years, Robot has been a leader in systems management for IBM i. With batch job creation and scheduling at its core, the Robot Job Scheduling Solution reduces the opportunity for human error and helps you maintain service levels, automating even the biggest, most complex runbooks. Manage your job schedule with the Robot Job Scheduling Solution. Key features include:

  • LANSA Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.

  • LANSAWhen it comes to creating your business applications, there are hundreds of coding platforms and programming languages to choose from. These options range from very complex traditional programming languages to Low-Code platforms where sometimes no traditional coding experience is needed. Download our whitepaper, The Power of Writing Code in a Low-Code Solution, and:

  • LANSASupply Chain is becoming increasingly complex and unpredictable. From raw materials for manufacturing to food supply chains, the journey from source to production to delivery to consumers is marred with inefficiencies, manual processes, shortages, recalls, counterfeits, and scandals. In this webinar, we discuss how:

  • The MC Resource Centers bring you the widest selection of white papers, trial software, and on-demand webcasts for you to choose from. >> Review the list of White Papers, Trial Software or On-Demand Webcast at the MC Press Resource Center. >> Add the items to yru Cart and complet he checkout process and submit

  • Profound Logic Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application.

  • SB Profound WC 5536Join us for this hour-long webcast that will explore:

  • Fortra IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn: