Considerations for changing QPWDLVL from 0 or 1 to 2
Password level 2 introduces the use of case-sensitive passwords up to 128 characters in length (also called passphrases) and provides the maximum ability to revert back to QPWDLVL 0 or 1.
Regardless of the password level of the system, password level 2 and 3 passwords are created whenever a password is changed or a user signs on to the system. Having a level 2 and 3 password created while the system is still at password level 0 or 1 helps prepare for the change to password level 2 or 3.
- Change the password for the user profile using the CHGUSRPRF or CHGPWD
CL command or the QSYCHGPW API. This will cause the system to change the password
that is usable at password levels 0 and 1; and the system also creates two
equivalent case-sensitive passwords that are usable at password levels 2 and
3. An all-uppercase and all-lowercase version of the password is created for
use at password level 2 or 3.
For example, changing the password to C4D2RB4Y results in the system generating C4D2RB4Y and c4d2rb4y password level 2 passwords.
- Sign on to the system through a mechanism that presents the password in clear text (does not use password substitution). If the password is valid and the user profile does not have a password that is usable at password levels 2 and 3, the system creates two equivalent case-sensitive passwords that are usable at password levels 2 and 3. An all-uppercase and all-lowercase version of the password is created for use at password level 2 or 3.
The absence of a password that is usable at password level 2 or 3 can be a problem whenever the user profile also does not have a password that is usable at password levels 0 and 1 or when the user tries to sign on through a product that uses password substitution. In these cases, the user will not be able to sign on when the password level is changed to 2.
- The user profile does not have a password that is usable at password levels 2 and 3.
- The user profile does have a password that is usable at password levels 0 and 1.
- The user signs on through a product that sends clear text passwords.
Any client that uses password substitution will not work correctly at QPWDLVL 2 if the client hasn't been updated to use the new password (passphrase) substitution scheme. The administrator should check whether a client which hasn't been updated to the new password substitution scheme is required.
- TELNET
- System i® Access
- System i Host Servers
- QFileSrv.400
- System i NetServer Print support
- DDM
- DRDA
- SNA LU6.2
It is highly recommended that the security data be saved before changing to QPWDLVL 2. This can help make the transition back to QPWDLVL 0 or 1 easier if that becomes necessary.
Avoid changing password system values, such as QPWDMINLEN, QPWDMAXLEN, and QPWDRULES, until after you have tested QPWDLVL 2. This makes it easier to transition back to QPWDLVL 1 or 0 if necessary. However, the QPWDVLDPGM system value must specify either *REGFAC or *NONE before the system allows QPWDLVL to be changed to 2. Therefore, if you use a password validation program, you might want to write a new one that can be registered for the QIBM_QSY_VLD_PASSWRD exit point by using the ADDEXITPGM command.
NetServer passwords are still supported at QPWDLVL 2, so any function/service that requires a NetServer password should still function correctly.
- If passwords greater than 10 characters are specified, the password level 0 and 1 password is cleared. This user profile will not be able to sign on if the system is returned to password level 0 or 1.
- If passwords contain special characters or do not follow the composition rules for simple object names (excluding case sensitivity), the password level 0 and 1 password is cleared.
- If passwords greater than 14 characters are specified, the NetServer password for the user profile is cleared.
- The password system values only apply to the new password level 2 value and do not apply to the system-generated password level 0 and 1 password or NetServer password values (if generated).