Gateway Bypassing monitor commands, SAP security note 1072946

SAP security note 1072946, “Gateway: Bypassing monitor commands”, is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

The gateway monitor allows only local monitoring when you set the parameter gw/monitor = 1. However, it also allows some remote monitoring.

These are:

• Displaying the release information
• Displaying connection information
• Displaying connection handle information (conversation ID)

Solution

The gateway does not allow queries from remote systems when you set the parameter gw/monitor=1. These changes are active with the following patch levels:

• 7.00: 116
• 6.40: 194

For these releases, the default of the parameter is still set to gw/monitor=2 and must also be set to 1. You can call transaction SMGW and choose Goto → Parameters → Change to do this dynamically (without restarting the instance). However, you must also make the change permanently in transaction RZ10 (instance profile parameter maintenance).

As a result, certain function modules (for example, the number of registered programs or querying the list of all connections) may report the error GWY_MONITOR_DISABLED.

Reason and prerequisites

Some transactions and reports try to display information about a remote system. Up to now, this information was ranked as not relevant for security. This ranking has been revised after a new security study.