OpenControls Logo

STIG Viewer

STIGViewer Support

IBM RACF exit ICHPWX11 for password phrases must be installed and properly configured.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-230210RACF-ES-000785SV-230210r998382_ruleCCI-004066medium
Description
Use of a complex password phrase helps to increase the time and resources required to compromise the password. Password phrase complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password phrase complexity is one factor of several that determines how long it takes to crack a password. The more complex the password phrase, the greater the number of possible combinations that need to be tested before the password is compromised.
STIGDate
IBM z/OS RACF Security Technical Implementation Guide2026-06-03

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-10Authenticator Management
0.50
IAC-10.1Password-Based Authentication
0.50
IAC-10.4Automated Support For Password Strength
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (61) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-12Session Termination
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00

+51 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.5.10
1.00
3.5.7
1.00
3.5.8
1.00
3.5.9
1.00
CCI1 mapping
CCI-004066
1.00

Details

Check Text (C-230210r998382_chk)

From a system console screen issue the following modify command: F AXR,IRRPHREX LIST Review the results of the modify command. If all of the following options are listed, this is not a finding. -The number of required character types is four. (ensures that at least one uppercase, one lowercase, one number, and one special character is used in password phrase) -The user's name is not contained in the password phrase. (Only three consecutive characters of the user's name are allowed) -The minimum password phrase length checked is 15. -The user ID is not contained in the password phrase. (Only three consecutive characters of the user ID are allowed) -The new password phrase is at least 50 percent changed positions of the old password phrase. (These positions need to be consecutive to cause a failure and this check is not case sensitive) -A minimum list of eight restricted words are being checked: 'IBM' , 'RACF', 'PASSWORD', 'PHRASE', 'PASSPHRASE', 'SECRET', 'IBMUSER', 'SYS1' If the modify command fails or returns the following message in the system log, this is a finding. IRX0406E REXX exec load file REXXLIB does not contain exec member IRRPHREX.

Fix Text (F-32519r868822_fix)

Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below: For z/OS release 1.12 through z/OS release 2.1, APARs OA43998 and OA43999 must be applied. Install exit IRRPHREX according to the following guidelines: REXX Parameter Setting Phr_minlen = 15 /* Minimum length */ Phr_maxlen = 100 /* Maximum passphrase length */ numbers = '0123456789' letters = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ' special = '&*@ :=!-%.#?|-' " Phr_allowed_chars = numbers||letters||special Phr_leading_blanks = 'no' Phr_trailing_blanks = 'no' Phr_name_allowed = 'no' Phr_name_minlen = 3 Phr_repeat_chars_chk = 'yes' Phr_userid_allowed = 'no' Phr_req_types = 4 Phr_min_unique = Phr_minlen % 2 /* 'Half' of chars must be unique */ Phr_min_unique_norm = 'yes' Phr_word_unique = 0 Phr_word_unique_upper = 'yes' Phr_word_minlen = 4 Phr_dict.1 = 'IBM' Phr_dict.2 = 'RACF' Phr_dict.3 = 'PASSWORD' Phr_dict.4 = 'PHRASE' Phr_dict.5 = 'PASSPHRAS Phr_dict.6 = 'SECRET' Phr_dict.7 = 'IBMUSER' Phr_dict.8 = 'SYS1' Note: RACF exit ICHPHX11 is coded to call a System REXX named IRRPHREX, so the name cannot be changed without a corresponding change to ICHPWX11. System REXX requires that this exec (IRRPHREX) reside in the REXXLIB concatenation. Update parameters in IRRPHREX according to table Parameters for RACF IRRPWREX as listed above.