The IBM RACF PASSWORD(HISTORY) SETROPTS value must be set to five or more.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-223728 | RACF-ES-000810 | SV-223728r998354_rule | CCI-004061 | medium |
| Description | ||||
| Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. HISTORY specifies the number of previous passwords that RACF saves for each USERID and compares with an intended new password. If there is a match with one of the previous passwords, or with the current password, RACF rejects the intended new password. | ||||
| STIG | Date | |||
| IBM z/OS RACF Security Technical Implementation Guide | 2025-06-24 | |||
Details
Check Text (C-223728r998354_chk)
From the ISPF Command Shell enter:
SETRopts List
If the PASSWORD(HISTORY) value is set properly then the message x GENERATIONS OF PREVIOUS PASSWORDS BEING MAINTAINED, where x is a minimum of "5", this is not a finding.
Fix Text (F-25389r998353_fix)
Configure the PASSWORD(HISTORY) SETROPTS value is set to a minimum of "5". This specifies the number of previous passwords that RACF saves for each USERID and compares with an intended new password. If there is a match with one of the previous passwords, or with the current password, RACF rejects the intended new password.
Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:
The RACF Command SETR LIST will show the status of RACF Controls including PASSWORD HISTORY.
Setting the password history to 10 generations is activated with the command SETR PASSWORD(HISTORY(10)).