Password and Passphrase Security › Password Controls › Password Masking

Password Masking

Password masking allows CA Top Secret to control the type of passwords that users can create. Password masks are set through the NEWPW control option, and will apply to all new passwords, including those that are randomly generated. Password masks are enforced system-wide for all users except the MSCA, who is exempt.

The character types used to define the mask include:

For example, the following would allow (or randomly generate) passwords such as TIGER or MONET.

NEWPW(MASK=CVCVC)

If all eight-character positions are not defined, then users are unrestricted. For instance, in the example above, the CVCVC only accounts for five of the eight character positions. Therefore, users would only have to follow the mask for the first five characters, but could specify whatever they wanted for the last three. Thus, passwords such as TIGER123 or MONETABC would also be valid.