Gateway Security configuration

[Former Member]

Hello,

I have a question regarding the security configuration of the SAP-gateway with regard to the SAP online help.

[SAP online help|http://help.sap.com/saphelp_nw04/helpdata/en/0a/64861a386e481c90400401e6f20bba/content.htm]

It says that there is a secinfo and a reginfo file for configuration.

Is it correct to say that the reginfo file works as the secinfo file BUT the reginfo file offers additional options such as NO (number of registrations allowed) and an ACCESS / CANCEL list for the execution and canceling of the application?

The secinfo parameters are as follows:

USER=<user>, [PWD=<pwd>,] [USER-HOST=<user_host>,] HOST=<host>,TP=<tp>;

Although the user entry is not used, you must specify it.

The secinfo parameters are:

TP=<tp> [HOST=<hostname>,...] [NO=<n>] [ACCESS=<hostname,...>] [CANCEL=<hostname,...>]

Besides the PWD parameter both seem to operate the same way...

Thank you!

[Former Member]

No. They serve a different purpose, but the control files have a similar format.

First of all I recommend using the [NW70Ehp1 docs|http://help.sap.com/saphelp_nw70ehp1/helpdata/en/48/b2096b7895307be10000000a42189b/frameset.htm] and not the NW04 ones and please also read the OSS notes on the two control files for more detailed information about changes to them and what they are intended for.

You can compare secinfo and reginfo (from the "use-case" for security usage) to the security settings which a reverse proxy performs, as compared to a forward proxy in the http protocol world.

The reginfo protects external systems from the SAP system so that they cannot be "hijacked" once a (possibly) legitimate program is being communicated with from the SAP system via the gateway.

The secinfo protects the SAP system's own server programs from being started from legitimate hosts. These will typically be "local" programs started from the system itself (this also includes the "local" context of a remotely called RFC enabled ABAP function module on the aplpication server!), but they can also be started remotely without the typical ABAP control options (authentication, authorization, some configuration)... which is what you should want to control!

In addition to previous SDN related threads (use the search) you can also check the blog space for the term "SAPTechEd hacker's lunch".

Please note that there have been some changes in this area, so you must keep your kernel and SP levels in mind.

It is not an easy topic you have chosen... Concentrate on the HOST parameters for quick (and imprortant) wins with low effort - pass the granular security to the applications (if you can trust them on those hosts).

Cheers,

Julius

[Former Member]

Hello Julius,

thanks for your detailed answer on my question. It's hard going on that topic for the first time...

I will put the focus on the secinfo configuration (USER-HOST and HOST configuration) at first as suggested.

Best regards,

Matthias

Edited by: Matthias Heil on Feb 22, 2010 9:21 PM

[Former Member]

Based on the link you provided above, I assume that you used the context sensitive application help (shortcut = .he) in transaction SMGW, right?

Retro-fitting it is tricky and depentent on the quality and maintenance of documentation (from experience you can forget it!).

SAP offers the training course ADM960 which deals with this topic (amongst others). If you want a very context specific "jump start" then there are a handfull of folks in SAP who who will be able to help you, but generally it is considered as consulting and not software support already (see the older SAP notes...).

Out of curiosity, please check in transaction RZ11 what the value is of param gw/monitor? This is often a symptom of how much (legacy) complexity you will have to deal with (particularly from external RFC capable server program vendors on their own host - i.e. reginfo!)

Cheers,

Julius

[Former Member]

This value is 1 (default).

[Former Member]

Okay, good. In that case concentrate on the Secinfo restrictions.

Cheers,

Julius

[Former Member]

Can someone advice me about the sap note 1298433 Security note: Bypassing security in reginfo & secinfo, In my opinion I think This error correction must be done carefully due could be a risk during the execution of jobs that use external programs causing that jobs finish with errors, losing files or external programs unable to connect

Thanks in advance