USR40 - password in exception list error message

[Former Member]

Hello,

At our company, we planned to maintain USR40 table with easily guessed passwords. We ended up preparing a quite a big list. There are as many as 4000 users and we are afraid that this may create a big impact. I say impact because the error message that pops up when user changes his password to one of the exceptional ones is as following:

"Password is in exception table"

Can we change the above error message to a customized one? We want to make it some what more detailed so that users are not frustrated.

Thanks for your help!

Regards.

[Former Member]

Hi there,

I believe you should be able to edit the message text in SE91, the message number is 194, but I have never edited this text - you will need to ensure the message class is entered as well. I suggest a trawl through the help for SE91 message maintenance and working with appropriate team to maintain these messages, as they're SAP standard. I think the message class for this one is 00.

Hope this helps,

Tom

Edited by: tvenables on Nov 6, 2009 4:58 PM

[Former Member]

Hi there,

I believe you should be able to edit the message text in SE91, the message number is 194, but I have never edited this text - you will need to ensure the message class is entered as well. I suggest a trawl through the help for SE91 message maintenance and working with appropriate team to maintain these messages, as they're SAP standard. I think the message class for this one is 00.

Hope this helps,

Tom

Edited by: tvenables on Nov 6, 2009 4:58 PM

[Former Member]

Thanks Tom for your reply...May be I should contact the ABAP team for the change...

It would be great if someone can let me know the steps to be followed..

[Former Member]

> We ended up preparing a quite a big list.

You will make a greater security gain, with much less effort and frustration... by simply requestion a minimum of 1 special character in the password.

This is particularly true if your "very big list" does not yet have any special characters in it...

Another usefull trick is to let each user know that there is this rule in the password's structure which they need to adhere to, without them having to take a guess at which pattern is permitted.

Actually, from gaps in patterns you can even take a better guess at what the admin's password is.... Mwwaahhh ha haha!

My 2 cents,

Julius

[Former Member]

You will make a greater security gain, with much less effort and frustration... by simply requestion a minimum of 1 special character in the password.

Thanks Julius. I was wondering if maintaining parameters such as the below ones would answer the external audit check for password rules.

login/min_password_digits

login/min_password_letters

login/min_password_specials

Do we still need the USR40 table maintained after the above parameters are maintained? In our case login/min_password_digits and login/min_password_letters both have a value 1.

Now, my actual question :)..It may not be possible for us to inform the 4000+ users...so somehow we wanted them to be notified in a user-friendly way...

Yes, you are right...if one is aware of the exception list then some possibilities may be eliminated :)...

[Former Member]

It depends on how you set the login/* parameters - as this will influence not only the structure of the password but also the likelihood of a certain pattern.

A classical example is if the password validity period is set to 30 days, then including the months (January, February, etc) is a good idea. More likely you have 90 days, so including the seasons will be a significantly better idea. But one special character somewhere in the password combined with a lock counter set to 5 (my recommendation) is much easier for the users to remember (as a rule, not the password...) and you to communicate to them.

Personally, when I get this USR40 message, then I do think a bit about the password quality and have a little list of known "silly passwords" like 'ASDF', 'SUMMER', 'TEST', etc which I maintain, but that's it. It should really be self-explanatory to the user that their password is rubbish. Otherwise, don't include it in the USR40 and concentrate on the special characters and possibly even 1 number to "break" the word or phrase.

> It may not be possible for us to inform the 4000+ users...so somehow we wanted them to be notified in a user-friendly way...

SM02 system message is one option. A session_manager transaction start at next logon is another. There is also an exit in the SAPGui logon program you could use.

Cool is also an email from the CEO to all employees, after you hack his / her password in a (legal!) audit

Cheers,

Julius

[Former Member]

Thanks again !

[Former Member]

This table actually has an amusing history, but as you have closed the thread I will save that for another day

If you take a read through the FAQ sticky thread at the top of the forum page, you will find a hint in the thread about "forcing" passwords.

Cheers,

Julius