Define the queue [page 17]
Installation/upgrade of SAP systems based on HANA Platform
The SAP Basis is responsible for the smooth operation of the programmes in the SAP system. It acts as an operating system for R/3 and subsequent releases including S/4HANA. Each operating system provides an environment in which programmes can run, such as MS Office on Microsoft Windows. Likewise, the SAP base system with the NetWeaver and HANA platform offers an environment in which the SAP programmes can run. In this context, the NetWeaver platform itself relies on server operating systems such as Windows and Linux.
This makes the technical user the dialogue user and a login in the SAP system is unrestricted. So Johannes logs in with the known password of the RFC user in the production system. Thanks to very extensive permissions, it now has access to all sorts of critical tables, transactions, and programmes in production. With the identity of the RFC user Johannes starts with the technical compromise of the production system... RFC Security: All invented - or everyday threat? Whether a simple trim, altered biometric properties or an encapsulated technical user in the SAP system: the basis of the compromise is the same. A person uses a different identity to gain access and permissions to protected areas. Moreover, the evil in all three stories could have been prevented by pro-activity. When was the last time you thought about the security of your RFC interfaces? Can you say with certainty that all your technical RFC users only have the permissions they actually need? And do you know who exactly knows the passwords of these users? Can you 100% rule out that not now in this moment an SAP user with a false identity infiltrates your production systems? Change now: It's about pro activity! But before you start now and start looking for the "identity converter" (which I really do not recommend!), I suggest that you take root of evil and proactively strengthen your RFC security. So if you want to find out more, I have the following 3 tips for you: 1) Our e-book about SAP RFC interfaces 2) Clean up our free webinar about RFC interfaces 3) Blog post about our approach to optimising RFC interfaces As always, I look forward to your feedback and comments directly below these lines!
High sense of responsibility
If you are running a multi-system landscape with a common transport directory, it is convenient to enable this option only in the first system you are inserting support packages into, and to disable it in the following systems. Since the data files no longer need to be regenerated there, this saves time when playing in. Delete data files after inserting You can specify whether the data files should be deleted after inserting the support packages. This saves disk space and is enabled in the default setting. If you are running a multi-system landscape with a common transport directory, it is convenient to disable this option, since then the data files in the other systems no longer need to be re-created (see above Regenerate data files). Execute ABAP/Dynpro generation This option determines whether the programmes and screens shipped with the support packages should be generated during the commit. Note that generation can take a long time. Without automatic generation, the programmes and dynpros are not generated until the first call. Note that this parameter can only be affected by you if the generation is allowed by SAP during the insertion of this support package. The SPAM update does not affect the generation. SPAM Settings Option SAPM Basic Setting Transmission Monitor From Scenario Standard Rebuild Data File A data file after the example. Delete Do a Generation From Use the transaction SPAM to insert Support Packages [page 8] into your system, regardless of whether the support packages come from the SAPNet - R/3 Frontend, the SAPNet - Web Frontend, or Collection CDs. Prerequisites User: It must have the appropriate permissions [page 7] for the SAP Patch Manager. He must be registered with the client 000. He must have called the transaction SPAM. Select Tools ABAP Workbench Tool Maintenance Patches or enter the transaction code SPAM.
A secure SAP system does not only include a good role concept. It is also necessary to check whether a user should (still) have a specific role. Regular verification of role assignment is called recertification. In this blog post, I'd like to introduce you to the need for recertifications and our own tool, EasyReCert. The need for recertification - scenarios: Example 1: The "apprentice problem" Imagine the following scenario: A new employee (e.g. apprenticeship or trainee) will go through various departments as part of his or her training and will work on various projects. Of course, an SAP User will be made available to your employee right at the beginning, which is equipped with appropriate roles. As each project and department passes, the employee repeatedly needs new permissions to meet the requirements. After the employee has successfully completed his or her induction and is now in a permanent position, he or she still has permissions that are not necessary to perform his or her duties. This violates the principle of "last privilede" and represents a potential security risk for your company. Example 2: The change of department The change of department is one scenario that probably occurs in every company. If a change of department does not automatically involve a complete reallocation of roles and the employee simply takes his old permissions with him, critical combinations of permissions can occur very quickly. For example, an employee who has permissions in accounts payable and accounts receivable violates the SoD ("Segregation of Duties") principle and poses a potential security risk to your company. Recertification as part of a revision: The two examples above show that a regular review of role allocation identifies potential security risks for your business and can be addressed.
For administrators, a useful product - "Shortcut for SAP Systems" - is available in the SAP basis area.
The programmes which this is approved are controlled by the reginfo ACL file.
Some useful tips about SAP basis can be found on www.sap-corner.de.
So it is about opening up the innovation process, as shown in Figure 2, which was presented earlier.