Skip to Content

Introduction

In the upcoming weeks, we will be posting new videos to the SAP HANA Academy to show new features and functionality introduced in SAP HANA 2.0 Support Package Stack (SPS) 02.

The topic of this blog is security.

For the previous version of this blog, see

For the full SAP HANA 1.0 SPS 11 blog list, see

 

Tutorial Video

SAP HANA Academy – SAP HANA SPS 11: What’s New? – Security – YouTube

 

What’s New?

Security Administration with SAP HANA Cockpit

Two new groups have been added to the SAP HANA cockpit

  • Security Overview
  • Certificate Management

With Security Overview, you can monitor critical security settings:

  • Network Security Information – displays cryptographic library and TLS settings
  • Data Storage Security – displays status of data encryption and last change of the SSFS master keys
  • Auditing – displays status of audit logging, policies and trail target

The Data Storage Security app and the Auditing app also allow for configuration of data volume encryption and auditing, respectively.

Screen Shot 2015-12-17 at 10.50.07.png

With Certificate Management, you can now use the Certificate Store and Certificate Collection apps to perform all certificate management tasks:

  • Import X.509 client certificates into the certificate store
  • Create certificate collections
  • Add trusted certificates and server certificates to collections
  • Set the purpose of collections

Screen Shot 2015-12-17 at 10.53.41.png

SAP HANA Academy – Documentation: SAP HANA Security – Certificate Management – YouTube

Password Policy

Three new parameters have been added to the password policy:

  • force_first_password_change
  • password_lock_for_system_user
  • detailed_error_on_connect

Parameter force_first_password_change governs whether the user needs to change the password upon first logon. For a technical user, this might not be necessary. This flag can also be set when creating or change a user with SQL.


CREATE USER <user_name> PASSWORD <password> [NO FORCE_FIRST_PASSWORD_CHANGE]

SAP HANA Academy – SAP HANA Security: Create User with NO FORCE_FIRST_PASSWORD_CHANGE [SPS 11] – You…

Parameter password_lock_for_system_user specifies whether or not the user SYSTEM is locked after the maximum number of failed logon attempts. The default value is true. The Security editor of the SAP HANA studio supports this setting but not yet in the Web-based Development Workbench (use SQL).

Screen Shot 2015-12-17 at 11.43.57.png

Parameter detailed_error_on_connect configures the detail level of error information returned when a logon attempt fails. The default value is false, which means that only the information authentication failed is returned. If this parameter is set to true, the exact reason for authentication failure is output

  • Invalid user password
  • User is locked
  • Connect try is outside validity period
  • User is deactivated

For internal applications more information might be helpful. For internet applications, however, security could be more easily compromised if too much information is provided.

Encryption

There was some ado last summer about the static encryption keys that were included with SAP HANA. See for example: SAP HANA security: Static encryption keys as the latest trend – ERPScan. Although the Security Configuration Checklist in the SAP HANA Security guide always clearly stated to change these keys prior to usage, alas not everyone was informed of this.

To make encryption both more secure and easier to use, the following changes have been implemented:

  • The initial master keys of the instance Secure Storage on the File System (SSFS) and the system PKI SSFS are now changed automatically after installation or upgrade. These keys are used for data storage and network encryption.
  • The initial default encryption key of the secure user store (hdbuserstore) is now automatically changed when the first entry is created. This store is the client-side tool for storing user logon information for connecting to an SAP HANA system, used for example for ODBC/JDBC connections for application servers, backup scripts, etc.
  • Communication encryption between SAP HANA processes (database engine, name server, application server, etc.) is now automatically enabled when internal communication in a multiple-host SAP HANA system is activated.

SAP HANA Academy – Documentation: SAP HANA Security – Secure Internal Communication – YouTube

Auditing

For data management purposes, you can now delete all audit entries in the database table used as audit trail target with SQL.


ALTER SYSTEM CLEAR AUDIT LOG ALL

This is for those exceptional cases that the table has grown so large that there is not enough memory to delete old entries. Better of course would be to do some regular monitoring of your audit tables!

The following user actions in SAP HANA can now be audited:

  • CREATE / DROP PROCEDURE
  • CREATE / DROP VIEW
  • STOP SERVICES

Screen Shot 2015-12-17 at 11.49.40.png

SAP HANA Multitenant Database Containers

You can now configure TLS/SSL keys and certificates for communication with HTTP clients per tenant database. See Configure HTTP(S) Access to Multitenant Database Containers – SAP HANA Administration Guide – SAP Library for how to set this up.

SQL Security Functions

Three new security functions have been added:

  • ESCAPE_DOUBLE_QUOTES
  • ESCAPE_SINGLE_QUOTES
  • IS_SQL_INJECTION_SAFE

They ensure that a valid SQL identifier is used in dynamic SQL statements to prevent SQL injections.


SELECT ESCAPE_DOUBLE_QUOTES('TAB"LE') "table_name" FROM DUMMY
table_name
TAB""LE

SAP HANA Academy – SQL Functions: Escape Single Quotes & Escape Double Quotes [SPS 11] – YouTube

SAP HANA Academy – SQL Functions: IS_SQL_INJECTION_SAFE [SPS 11] – YouTube

SAP Security Baseline Integration

Integration of SAP HANA into SAP Security Baseline, Early Watch Alert and Configuration Validation has been improved. The checks were first delivered with the SAP Solution Manager Plug-In ST-SER 620_2005_1 and they have been revised several times since then. See SAP Note: 863362 – Security checks in SAP EarlyWatch Alert, EarlyWatch and GoingLive sessions

Screen Shot 2015-12-17 at 12.02.35.png

Documentation

SAP Library

SAP Notes

SCN

Thank you for watching

The SAP HANA Academy provides technical enablement, implementation and adoption support for customers and partners with 1000’s of free tutorial videos.

For the full library, see SAP HANA Academy Library – by the SAP HANA Academy

For the full list of blogs, see Blog Posts – by the SAP HANA Academy

 

To report this post you need to login first.

1 Comment

You must be Logged on to comment or reply to a post.

Leave a Reply