OpenVMS Password Policysm
PARSEC Group has developed an easy-to-implement, site-specific, password policy for OpenVMS V6.2 and later systems. This allows more control and enforcement of password policies than what is built into OpenVMS. Read Password Policies for more general information about setting up a policy.
Character Sets
The character set used for passwords is divided into four groups of characters. These are:
- Upper-case characters (A-Z)
- Lower-case characters (a-z) - Note: available with OpenVMS V7.3-2 and later
- Numeric characters (0-9)
- Other characters
A good password policy requires the use of multiple characters from each group which makes it tougher for a hacker to guess. Using all groups guarantees that it is not in a dictionary and provides many more combinations of characters for a more secure password. The policy should also disallow the use of the username and several other common practices as part of the password. Once a policy has been set up, the operating system should enforce the policy as much as possible since some users may not be trusted to follow it and others might forget some details.
Password Policy Features
The PARSEC Group OpenVMS Password Policysm is a flexible module that may be configured using logical names. Basic password policy features include:
- Minimum number of groups of characters required
Users may be required to use characters from multiple groups of characters. On versions of OpenVMS which do not support lower-case characters, and for accounts which have not had this feature enabled, lower-case characters will not be required. - Minimum number of characters from each group
Users may be required to use a minimum number of characters from each of the four groups. - Limit number of repeated characters
Passwords such as "testing777" may be prevented due to the same character being repeated too many times. - Limit number of sequenced characters
Passwords such as "testing123" and "321blastoff" may be prevented due to too many characters in a sequence. - Prevent use of username
The username may be prevented from being a portion of the password. - Prevent use of owner
The user may be prevented from using any component of the owner field longer than one character as part of the password. - Minimum password length
A system-wide minimum password length may be set to prevent an account from being intentionally or unintentionally set with too few characters.
Other features include:
- Maximum length checked
The policy may be set to be enforced within the first portion of the password. For example, a user could specify a 30-character password, but the minimum number of character groups and the minimum number of groups of characters may be required to be present in the first 12 characters. - Notification
The user may be notified which portions of the policy that is not met by their chosen password. This makes it easier for them to choose a secure password. - Hash value check
The hashed value of the password may also be checked. While the user does not directly control this, a weak hashed value can make passwords easier to compromise.
System Requirement
Requirements: One of the following versions of OpenVMS is required:
- OpenVMS I64 V8.2 or later
- OpenVMS Alpha V6.2 or later
- OpenVMS VAX V6.2 or later
You may download the PCSI kit for the password policy or review the on-line documentation. Before installing, be sure to request a license from PARSEC Group.
If this policy does not meet your needs, please contact us about developing a custom password policy based on your security policy.
For additional information, to request a demo license, or to purchase the OpenVMS Password Policysm, please contact us at 888-4PARSEC, send an e-mail to experts@parsec.com or use our inquiry form.