Security of RFC, password setting?

[Former Member]

Dear all,

I wanner know should the RFC connections be secured in such manner that any user who makes use of a connection will be prompted to enter a user name and password??

The RFC can directly log on to another R/3 system from table RFCDES if the password field is blank or *?? Is it right?

By transaction SM59, how can I know whether the password was set for a connection?

What does the "Saved" or "is initial" of "PW Status" mean?

Many thanks.

[Former Member]

Eric,

I wanner know should the RFC connections be secured in such manner that any user who makes use of a connection will be prompted to enter a user name and password??

then, go for Trusted RFC connection (logon / security)

The RFC can directly log on to another R/3 system from table RFCDES if the password field is blank or *?? Is it right?

No, password needs to be synced from both sides.

By transaction SM59, how can I know whether the password was set for a connection?

Try with "Test connection"

What does the "Saved" or "is initial" of "PW Status" mean?

No authorization to logon as trusted system (Trust"

I noticed that CLIENT FIELD under "Logon & Security" - "Logon" IS BLANK, and curent user is checked. PW Status "is initial"

Thanks,

Sri

[Former Member]

Many thanks for your answer!

However, I am still a little confusing about the security mechanism of RFC. Especially about the setting of "User and Password" in SM59. Is there any materials to be referenced?

[Former Member]

Hi,

You can also verify the pw status from: SM59 => Utilities => Test => Authorization Test (It provides usefull information on user avalability). Also look for "RFC User Administration" :

http://help.sap.com/saphelp_sm32/helpdata/en/ed/8d7b64ee75ef4cb42358427613fa95/frameset.htm

Regards;

[Former Member]

If you do a simple search then you will find what you are looking for.

The RFC security guides and docs for transaction SECSTORE would be a good place to start.

If you want a jump-start to SAP infrastructure security then go for training course ADM960.

Cheers,

Julius