The MQ Appliance network device must prohibit password reuse for a minimum of five generations.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-74951	MQMH-ND-000570	SV-89625r1_rule		Medium

Description
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. To meet password policy requirements, passwords need to be changed at specific policy-based intervals. If the MQ Appliance network device allows the user to consecutively reuse their password when that password has exceeded its defined lifetime, the end result is a password that is not changed as per policy requirements. For LDAP authentication, the authentication server is responsible for enforcing password policy. When the LDAP server is not available, password policy is enforced by the MQ Appliance's RBM Password Policy.

Description

Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. To meet password policy requirements, passwords need to be changed at specific policy-based intervals. If the MQ Appliance network device allows the user to consecutively reuse their password when that password has exceeded its defined lifetime, the end result is a password that is not changed as per policy requirements. For LDAP authentication, the authentication server is responsible for enforcing password policy. When the LDAP server is not available, password policy is enforced by the MQ Appliance's RBM Password Policy.

STIG	Date
IBM MQ Appliance v9.0 NDM Security Technical Implementation Guide	2017-06-06

Details

Check Text ( C-74809r1_chk )
Log on to the MQ Appliance WebGUI as a privileged user. Go to Administration (gear icon) >> Access >> RBM Settings. Verify the Authentication Method is set to LDAP. Expand Password Policy. Verify the (local) MQ Password Policy Reuse History is set to a minimum of "5". If MQ is not set to LDAP authentication or if the local password policy is not configured to meet the requirement, this is a finding.

Check Text ( C-74809r1_chk )

Log on to the MQ Appliance WebGUI as a privileged user. Go to Administration (gear icon) >> Access >> RBM Settings.

Verify the Authentication Method is set to LDAP.

Expand Password Policy.

Verify the (local) MQ Password Policy Reuse History is set to a minimum of "5".

If MQ is not set to LDAP authentication or if the local password policy is not configured to meet the requirement, this is a finding.

Fix Text (F-81567r1_fix)
Log on to the MQ Appliance WebGUI as a privileged user. Go to Administration (gear icon) >> Access> > RBM Settings. Set Authentication Method to LDAP. Configure LDAP server connection as required. Expand Password Policy. In Password Policy, check the Control Reuse check box and set reuse history to a minimum of "5".