RACF Password Expiry.

vasanthz · Posted: Tue Aug 17, 2010 7:47 pm

Hi,

I have access to 30 to 40 lpars, but I use them only rarely (i.e. if there is an issue)
At our shop, if an ID is not used for over 45 days then the ID is removed from the system completely and some of my IDS got removed.
To avoid this I am planning to setup a job to keep my ID active on all LPARs.

All the LPAR nodes support JES transmission of job, so if the below job is run on single master LPAR once in 30 days & transmit the job to other LPARs, please let me know if this would prevent RACF from removing my ids?

Password changing job:

Anuj Dhawan · Posted: Tue Aug 17, 2010 8:35 pm

vasanthz · Posted: Tue Aug 17, 2010 8:37 pm

Hi,
Yes,I have different IDs for them, maintaining the ID & passwords for each one is a task onto itself.

Regards,

enrico-sorichetti · Posted: Tue Aug 17, 2010 8:49 pm

if Your auditors are a bit smart, You might get questioned, with rather unpleasant results
keep-alive tricks are frowned upon in most organizations

the best thing would be to review with the powers the setup,
the issue should be common also to other people

vasanthz · Posted: Tue Aug 17, 2010 9:14 pm

Enrico, Thanks for responding.
I did not look at it in that perspective. I don't think there is much can be done than me manually logging into all of them once. mmm...

vasanthz · Posted: Tue Aug 17, 2010 9:20 pm

Hi,
If I was changing my passwords once a month and if the RACF does not flag me as inactive user, then I guess the blame is on the RACF.

Regards,

enrico-sorichetti · Posted: Tue Aug 17, 2010 9:21 pm

maybe I did not express clearly my thoughts
manual or automatic, it will make little difference,
as I said if the auditors have a sound approach to auditing
an ID which logins/logons to a system only once every 40 days is still something to investigate
( seen it, done it, at the end there was no reason for the ID to be there )

dick scherrer · Posted: Tue Aug 17, 2010 9:22 pm

Hello,

I simply log on and change the passwords each month. . .

It is a pain, but doesn't really take long. . .

And it is not near the pain of having to get an id re-instated. . .

vasanthz · Posted: Tue Aug 17, 2010 11:34 pm

I agree D.

santy · New User Joined: 19 Jul 2007 Posts: 22 Location: mumbai

most simple option i m using is to login and changing the password manunally from the login screen once in month.

that's the best option to come out through this problem.:)