HANA and HANA’s Security Parameters
HANA and HANA’s Security Parameters
While a users login to HANA box the system authenticate users with below requirements.
a. Username and password verified.
b. Whether the user account is within the validity period.
c. Whether the user account is active.
Passwords for users are subject to certain parameters / rules what we call passwords policy. You can configure your password policy in security editor of HANA studio as below screenshot.
1. Minimum Password length : – The minimum number of characters that the password must contain – Default value between 6 – 24
2. Password_layout – Lowercase (a – z), UPPERCASE (A – Z), Numerical digits (0 – 9) – Default Values – Aa1
3. Force_first_password_change – Defines the users have to change their password immediately after there first time they log on. Default value – True
4. Last_users passwords – Not allowed to reuse when changing his / her current password – Default Value – 5
5. Number of allowed failed logon – Max Number of failed logon attempts that are possible – Default – 6
6. Password_lock_time – The number of minutes for which a users is locked after maximum number of failed attempt – Default value is 1440 minutes i.e.. 1 day
7. Maximum Password Lifetime – Number of days after which a user passwords expires – Default 182
8. Life time of Initial Password ( maximum_unused_initial_lifetime – Default values is 7
9. Maximum durations of Users Inactivity – max number of days after which a password expires if the users has not logged on, Default – 365 (in Days)
10. Notification of Password Expiration (passwords_expire_warning_time) – Number of days before a passwords is due to expire that the user receive notification – Default Value – 14
@ Ref : HANA Security Guide
@ Changed from Blog to Document
"@Ref: HANA Security Guide?" 😯 ..more like a copy-paste from the security guide 🙁
Hi Benedict,
although this material is pretty weak and not more than a quick list of notes on security related parameters it's not violating the RoE as the content is not actually copy&past'ed from any SAP documentation.
Also, the source of the information had been somewhat mentioned, so this is 'legal' in my eyes.
However, everyone who is interested in all things related to SAP HANA should go and visit the fully revamped SAP HANA Security Guide.
Another great piece of documentation authorship from Ralph Schroeder and his team.
- Lars
For those interested, there is also a playlist on SAP HANA security on the SAP HANA Academy:
SAP HANA Security - YouTube
Regards,
Denys