HANA Audit does not log failed login attempts

[former_member297082]

Hello community,

could you please give me a quick hint on this issue?
I've created an audit policy via HANA Studio and deployed it.

Policy is enabled, I'd like to audit CONNECT, DISCONNECT SESSION, CANCEL SESSION, actions are ALL, audit Level is WARNING and before that I also tried INFO and the user is correct.

The problem is I only see successful Login attempts in the syslos and no failed attempts for example when I type in wrong Passwords in HANA Studio (Adding the System with another user). As soon as I enter the correct Password it Shows up in the logs. We need to see all failed login attempts.

The audit policy also ignores when the user gets locked, but I guess that's another story.

[Former Member · Accepted solution]

Hi Nicolai.

Please take a look at the SAP HANA Security Guide (page 151,...)

http://help.sap.com/hana/SAP_HANA_Security_Guide_en.pdf

If you have the CONNECT audit, when it fails to login you should get this kind o log message in the syslog:

[...]

;INFO;CONNECT;SYSTEM;;;;;;USERNAME;UNSUCCESSFUL;;;;;;invalid username or password

You can also take a look at the SYS SCHEMA --> Views --> USERS

You can monitor the LAST_INVALID_CONNECT_ATTEMPT or the INVALID_CONNECT_ATTEMPTS

Regrads.

Osvaldo Dias Ferreira

[former_member297082 · Accepted solution]

Thank you, but I still don't get any other Messages than the SUCCESSFUL Messages with type INFO. I've made sure that my policy is correct...

[former_member267944]

It is important to specify the action status in the Audited Action status tab. The following values are available:

SUCCESFUL

UNSUCCESFUL

ALL

[rindia]

Hi Nicolai,

If the purpose is to see how many are the the invalid attempts, then you can directly query the table USERS

SELECT * FROM USERS WHERE USER_NAME = 'give_user_name';

If you want to know the detailed information for whats wrong then you can set the Configuration parameter:

If Single Container:

indexserver.ini  => password policy => detailed_error_on_connect => true

If Multiple container:

nameserver.ini  => password policy => detailed_error_on_connect => true

If set to false, only the informationauthentication failedis returned.

If set to true, the specific reason for failed logon is returned:

• Invalid user or password
• User is locked
• Connect try is outside validity period
• User is deactivated

Details for configuration is here.

Regards

Raj Kumar Salla

[former_member297082]

Thanks, but it still doesn't work.

All I see in the syslog are the SUCCESSFUL (INFO) Messages, but there is no message about an unsuccessful login via HANA Studio.

[Former Member]

Can you try the below.

Audit Action Type ALL

Create Two Audit policies at a time with Audit level Alert & Critical.

Regards,

Pavan Gunda