Password Syntax Rules

If you have the SPECIAL attribute, you can establish up to eight password syntax rules to verify that new passwords meet the installation standards. These rules allow you to control:
  • Minimum and maximum length of passwords
  • Character content of installation-selected positions in the passwords

Restriction: The password syntax rules you define are not enforced when users log on with their current passwords. Therefore, changes you make to your password syntax rules will not affect users with current passwords. Your changes will take effect for current users only when they change their passwords. For new users, the changes will take effect when the new user logs on for the first time. In addition, password syntax rules are not enforced when you define a temporary password for another user using the ALTUSER PASSWORD command unless you specify the NOEXPIRED option.

You establish these rules by using the RULEn suboperand specified by the PASSWORD operand of the SETROPTS command. The following example shows how you can establish a syntax rule for new passwords for your installation. 
SETROPTS PASSWORD(RULE1(LENGTH(8) VOWEL(1,3,5:8) NUMERIC(2,4)))

The command establishes syntax rule RULE1. Syntax rule RULE1 specifies that new passwords must be 8 characters in length and contain vowels in positions 1, 3, 5, 6, 7, and 8 and numbers in positions 2 and 4. Thus, the password “A2E2EAEE” follows the rule, and “C3DMIER5” does not.

The following example shows a command establishing syntax rule RULE2. 
SETROPTS PASSWORD(RULE2(LENGTH(8) MIXEDALL(1:8)))
Syntax rule RULE2 specifies that new passwords must be 8 characters in length and contain at least one character from every active character category somewhere in the password. Up to four character categories can be active:
  • Uppercase alphabetic characters (not including the national characters)
  • Lowercase alphabetic characters, if SETROPTS PASSWORD(MIXEDCASE) is enabled
  • Numeric characters
  • National characters, and the special characters if SETROPTS PASSWORD(SPECIALCHARS) is enabled

If you do not define a value for every position specified by the LENGTH value, the undefined positions can contain any combination of alphanumeric characters.

Note: If the RACF® ISPF panels are installed, you should consider using the RACF ISPF panels to set up password syntax rules.