Authorized access to SAPHTTP, SAP security note 1391464

SAP security note 1391464, "Authorized access to SAPHTTP", is a consulting note released on 09.02.2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The settings defined for SAPHTTP do not include authorization checks based on user or the source of the request. No authorization checks are performed in the system while starting the external program SAPHTTP.

Every ABAP installation includes the external program SAPHTTP. To ensure system security, authorized access to this program is necessary and can be achieved by implementing this note. These settings need to be maintained regardless of whether SAPHTTP is used or not.

Solution

Implement an access control list in the SAP gateway to secure the system and prevent unauthorized access. The solution covers various scenarios based on the destination settings maintained using transaction SM59:

• Scenario A: External Program started on the same application server.
• Scenario B: External Program started on a Front End Machine.
• Scenario C: External Program started on an Explicit Host where the call is initiated from the source application server ("src_as") to start SAPHTTP on the target application server ("trgt_as").
• Scenario D: When the external program SAPHTTP is not used.

Steps to maintain security settings:

• Maintain the "secinfo" file at path /usr/sap/<SID>/data/secinfo. For Scenarios A and B use: USER=<user name>, USER-HOST=local, HOST=local, TP=saphttp; For Scenario C on "src_as": USER=<user name>, USER-HOST=local, HOST=<trgt_as>, TP=saphttp; and on "trgt_as": USER=<user name>, USER-HOST=<src_as>, HOST=local, TP=saphttp; For Scenario D use: USER=*, USER-HOST=local, HOST=local, TP=saphttp;
• Set the profile parameter gw/sec_info using transaction RZ11 to point to the location of the "secinfo" file.
• Activate the configuration file using transaction SMGW, navigating to Goto -> Expert Functions -> External Security -> Read Again.
• Optionally maintain gateway logging using transaction SMGW, navigating to Goto -> Expert Functions -> Logging.
• Repeat these steps on all application server instances.

Entries in the "secinfo" file are case-sensitive; maintain one entry for every authorized user or application server as required. Security settings become active only if the "secinfo" file exists with the corresponding entries for SAPHTTP. Refer to Note 110612 for further details on "secinfo" file settings.

Reason and prerequisites

Note 1298433 ensures that the SAP Gateway Access Control Lists cannot be bypassed.

References

Affected components

• SAP_BASIS: 46B to 46D
• SAP_BASIS: 610 to 640
• SAP_BASIS: 700 to 702
• SAP_BASIS: 710 to 720