Safeguard Reference Manual (G06.29+, H06.08+, J06.03+)

Safeguard Subsystem Commands
Safeguard Reference Manual — 520618-030
16 - 9
ALTER SAFEGUARD Command
n defines the maximum number of failed authentication attempts allowed
before the defined actions take place. The default value is 3. (Action is not
taken until after three consecutive invalid attempts have been made.) A value
of 0 specifies no limit to the number of failed logon attempts. A null entry for
this attribute resets the value to the default value.
AUTHENTICATE-FAIL-TIMEOUT [ n [ units ] ]
n defines the length of time to suspend the logon process at the terminal when
AUTHENTICATE-MAXIMUM-ATTEMPTS has been exceeded. The default
value is 60 seconds. (A process is suspended for one minute after exceeding
AUTHENTICATE-MAXIMUM-ATTEMPTS invalid attempts to log on.) units
can be one of the following: SECONDS, MINUTES, HOURS, DAYS, WEEKS,
MONTHS. A null entry for this attribute resets the value to the default value.
AUTHENTICATE-FAIL-FREEZE { ON | OFF }
defines whether to freeze a user ID automatically (as if FREEZE USER had
been invoked) if AUTHENTICATE-MAXIMUM-ATTEMPTS has been exceeded
against that user ID. The initial value is OFF. (User IDs are not automatically
frozen.)
PASSWORD-HISTORY n
n defines the number of previous p
asswords to retain in a per-user-ID
password database. Any new password must be different from all the
previously retained passwords to be acceptable. The initial value is 0.
(Passwords are not subject to a history.)
PASSWORD-MINIMUM-LENGTH n
n defines the minimum character length of a new p
assword. (Present
passwords are not affected.) The initial value is 0 and the maximum value is 8
for DES algorithm and 64 for HMAC256 algorithm.
PASSWORD-MAY-CHANGE [ n [ DAYS [ BEFORE-EXPIRATION ] ] ]
n defines the number of days before the p
assword expiration date in which the
users can change their own password. If no password expiration date is in
Caution. Because the command interpreter process at the terminal remains locked for the
duration of the AUTHENTICATE-FAIL-TIMEOUT period, avoid specifying an unreasonably
long period. The terminal is effectively not usable during this period. The only recovery is to
start a new process at the terminal.
Caution. If you set AUTHENTICATE-FAIL-FREEZE ON, a user can freeze the user IDs of
oth
ers by attempting to log on with those other user names or user IDs.
Note. A password can be any length, including a null password. The initial value of
P
ASSWORD-MINIMUM-LENGTH is six only on systems running G06.29 and later
G-series RVUs and H06.06 and later H-series RVUs.