Authorized access to SAPFTP, SAP security note 1391655

SAP security note 1391655, “Authorized access to SAPFTP”, is a consulting note released on 12.02.2013. Below are the symptom and SAP recommended solution.

Description

Symptom

The settings defined for SAPFTP do not include authorization checks based on the user or the source of the request. No authorization checks are performed in the system when starting the external program SAPFTP.

Every ABAP installation includes the external program SAPFTP. To ensure system security, authorized access to this program is necessary and can be achieved by implementing this note. These settings need to be maintained regardless of whether SAPFTP is used or not.

This security note has been updated. For more detailed information, see Security Note 1819543.

Solution

Implement an access control list in the SAP gateway to enable a secure system that prevents unauthorized access. Follow these steps based on different usage scenarios of SAPFTP:

• Scenario A: External Program started on the same application server.
• Scenario B: External Program started on the Front End Machine.
• Scenario C: External Program started on an Explicit Host where the call is initiated from the source application server “src_as” (local system) to start SAPHTTP on target application server “trgt_as”.
• Scenario D: When external program SAPFTP is not used.

• Maintain the secinfo file (default path /usr/sap/<SID>/data/secinfo):
  • For Scenarios A and B: USER=<user name>, USER-HOST=local, HOST=local, TP=sapftp; This allows the specified user to access the SAPFTP program within the same application server or on the front-end machine.
  • For Scenario C, based on user – settings in application server “src_as”: USER=<user name>, USER-HOST=local, HOST=<trgt_as>, TP=sapftp;; settings in application server “trgt_as”: USER=<user name>, USER-HOST=<src_as>, HOST=local, TP=sapftp;. This allows the specified user to access SAPFTP on “trgt_as” from “src_as”.
  • For Scenario C, based on source of request – settings in application server “src_as”: USER=*, USER-HOST=local, HOST=<trgt_as>, TP=sapftp;; settings in application server “trgt_as”: USER=*, USER-HOST=<src_as>, HOST=local, TP=sapftp;. This allows access to SAPFTP on “trgt_as” only if the request comes from “src_as”.
  • For Scenario D: USER=*, USER-HOST=local, HOST=local, TP=sapftp; This restricts requests to the local application server only, blocking all external requests.
• Configure the profile parameter: use transaction RZ11 to set the profile parameter gw/sec_info pointing to the location of the secinfo file (default /usr/sap/<SID>/data/secinfo).
• Activate the configuration file: use transaction SMGW, then Goto > Expert Functions > External Security > Read Again.
• Maintain gateway logging if necessary: use transaction SMGW, then Goto > Expert Functions > Logging. Save and activate these settings.
• Repeat these steps on every application server instance of the R/3 system.

Settings in the secinfo file are case-sensitive. Maintain one entry for every authorized user or application server as required. Security settings for SAPFTP are active only if the secinfo file exists with the correct entries. Refer to Note 110612 for further details.

Reason and prerequisites

Note 1298433 becomes the prerequisite note, which ensures that the SAP Gateway Access Control Lists cannot be bypassed.

References

• Problems with SAPFTP (93042)
• Update 1 to security note 1391655 (1819543)
• Overview note: “reg_info” and “sec_info” (1305851)
• Bypassing security in reginfo & secinfo (1298433)