Prevent viewing of saplogon.ini

[former_member323185]

Hi,

Is there anyway to prevent a user from opening the saplogon.ini file with an editor and view the content of the file? I am trying to do that in order to prevent sensitive saproute strings from being revealed.

Thanks.

Regards,

Lim

[jude_bradley · Accepted solution]

As far as I know, the file can be made read-only,but there is nothing to stop an end-user viewing the file.

The only alternative I can think of,is to restrict users from using a text editor using group policy.

https://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx

Regards,

Jude

[Matt_Fraser]

Ultimately, other than the group policy route suggested by Jude, I don't think you can do this. The SAPLogon (or SAPLogon-Pad) must be able to read the saplogon.ini file in order to connect to the servers, and since SAPLogon runs in the context of the user, that means the user must be able to read the file. You can prevent editing of the file, obviously, either through SAPLogon-Pad (which doesn't really prevent much), or by keeping it in a read-only centralized location on a server (much better option), but you can't really stop someone from reading it if they need to use it for their work.

What about the saproute strings is so sensitive?

[former_member323185]

Our saplogon.ini contains entries to many customers' SAP systems. The saproute strings also reveal the saprouter password of our customers' saprouter. If a user who works temporary on a customer's system, he/she who has access to the saproute string may copy it to another saplogon installation and gain access to the logon screen of the customer's SAP system.

Yes we can delete the user account or disabled it but we prefer temp users not to know the saproute string of a customer's SAP system.

[jude_bradley]

Hello Mr Lim,

That is not a very good policy you have there. Suggest you rethink your saplogon.ini layout for better security.

Jude

[thanga_prakash]

Hello Wee Seng Lim,

The main reason behind your question is you don't want any users to edit the server information in logon pad, If it is so, then you can disable the edit button by following below steps.

Click on top left corner of the logonpad and then go to options --> SAP Logon options --> General --> Check on the "Disable editing of connection entries" --> close the logon pad and relaunch again.

You will find the EDIT button in logon pad Disabled (Greyed out)

Regards,

TP

[former_member323185]

Hi Thanga,

The main objective is to prevent user from opening the saplogon.ini file. SAPLogon Pad by itself already can prevent users from editing the connection entries.

Regards,

Lim