Disabling HTTP services in WebAS 6.10, SAP security note 481543

SAP security note 481543, "Disabling HTTP services in WebAS 6.10", is a workaround of missing functionality note released on 08.10.2009. Below are the symptom and the SAP recommended solution.

Description

Symptom

In WebAS 6.10 by default all HTTP Services are accessible.

Solution

When installing SAP Web Application Server 6.10, the installation includes a number of testing, demonstration, and sample applications accessible via corresponding services. These samples are useful for training and developing customer applications. For productive operations, only the minimal set of required services and applications should remain active and accessible over the web.

This note describes how to deactivate all services present after an initial installation of SAP Web Application Server 6.10 and activate only those that should be accessible from the Web. Follow these steps:

• Create a Service Entry for Your Application: use transaction SICF and create a node for your application under the path default_host/sap/bc/bsp/sap. For example: default_host/sap/bc/bsp/sap/myapp
• Create a New Virtual Host: at the uppermost level of SICF, create the new virtual host. Set it to number 1 and save. The new virtual host should be displayed. Next, create a node in that virtual host. You can either introduce a new tree according to your needs or directly create an alias to the node in default_host.
  • Example a: my_virt_host > customer > webapp – webapp should be aliased to default_host/sap/bc/bsp/sap/myapp
  • Example b: my_virt_host > webapp
• Disable the default_host and Enable the New Virtual Host: edit the instance profile to include the following lines: is/HTTP/virt_host_0 = a:b; is/HTTP/virt_host_1 = *:*; This configuration effectively disables virt_host_0 (the default_host) by matching only an impossible machine/port combination (a:b), unless such a machine/port exists in your network. virt_host_1 now matches all machine:port pairs and is enabled. You can further restrict it by providing explicit host names and port numbers if necessary.
• Restart Your WAS: after completing the above steps, restart your Web Application Server. This ensures that it is impossible to reach any service in the default_host tree. Only services in my_virt_host will be accessible. To invoke your BSP application, use URLs like machine:port/customer/webapp/page.htm or machine:port/webapp/page.htm

References

• 626073 – Unreleased Internet Communication Framework services
• 492283 – Problem activating SICF services