Security settings in the message server, SAP security note 821875

SAP security note 821875, “Security settings in the message server”, is a note. Below are the symptom, SAP recommended solution, related references and the affected software components.

Description

This security note provides guidance on enhancing the security configurations of the SAP message server. It outlines the necessary settings to increase the security level, manage access control, and troubleshoot related issues.

Symptom

After increasing the security settings of the message server, you may encounter the following issues:

• Access Denied Errors: For example: MsSClientHandle: client 212.190.195.45 is EXTERNAL, access denied [msxxserv.c 4843]
• Event Trigger Failures: No events can be triggered via sapevt, resulting in trace entries indicating access denial.

Solution

To address these issues and enhance the security of the message server, follow the steps below:

1. Administration Settings

• ms/monitor Parameter: 0 – Only application servers can change the internal memory and execute monitor functions (default). 1 – External monitoring programs (e.g., msmon) can also make changes.
• ms/admin_port Parameter: Default value 0 (administration via external programs is deactivated). Set to a specific port number greater than 1024 to allow administration via external programs. Configuration: use transaction SMMS → Go to → Security Settings to open or close the administration port dynamically.

2. Separation of Internal and External Communication

• rdisp/msserv_internal Parameter: Uses a separate data channel for internal (application servers) and external communication. Configuration steps: define a different port for internal communication, ensure all application servers use the internal port, then restart both the message server and application servers for changes to take effect. Benefits: prevents unauthorized external clients from performing administrative tasks and ensures that programs like sapevt connect through the internal port to trigger events successfully.

3. ACL List Configuration

• ms/acl_info Parameter: Default file /usr/sap/<SID>/SYS/global/ms_acl_info. Purpose: specifies access rights to the message server, listing allowed machine names, domains, IP addresses, and subnet masks. Syntax examples: HOST=* (all hosts are allowed), HOST=host1,host2, HOST=*.sap.com, HOST=147.45.56.32, HOST=147.45.56.*. Security: protect the ACL file from unauthorized modifications and activate ACL reading via transaction SMMS to manage dynamic entries.

References

• sapevt (Version 5): Security settings in the Msg. – SAP Note 826779
• Additional info: Upgrade to SAP NW 2004s AS ABAP (iSeries) – SAP Note 822296

Affected components

• SAP_BASIS 6.40
• SAP_BASIS 7.00
• SAP_BASIS 7.01
• SAP_BASIS 7.10
• SAP_BASIS 7.11