gw/reg_no_conn_info settings, SAP security note 1444282

SAP security note 1444282, "gw/reg_no_conn_info settings", is a customizing note released on 29.04.2016. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This security note has been updated. For more detailed information, see security notes 1633982 and 1697971.

Other SAP Notes refer to the parameter gw/reg_no_conn_info to configure the security settings of the gateway. These SAP Notes do not provide any concrete values for the parameter, however.

Solution

Description of the parameter

• The parameter gw/reg_no_conn_info can be a positive integer. It is used as a bit mask.
• Each security-relevant SAP Note that can be activated by gw/reg_no_conn_info (see the list below), contributes a value of X to the total value. The sum of all values (that is, the SAP Notes for which you want to activate the function) provides the value of the parameter.

Value X Note Short Text:

• 0 – (no additional security active)
• 1 – 1298433 Bypassing security in reginfo & secinfo
• 2 – 1434117 Bypassing sec_info without reg_info
• 4 – 1465129 CANCEL registered programs
• 8 – 1473017 Uppercase/lowercase in the files reg_info and sec_info
• 16 – 1480644 gw/acl_mode versus gw/reg_no_conn_info
• 32 – 1633982 Update #1 for Security Note 1444282 (NEW: October 2011)
• 64 – 1697971 GW: Enhancement when starting external programs (NEW: March 2012)
• 128 – 1848930 GW: Strong gw/proxy_check (NEW: April 2014)

If you activate the functions of all security-relevant SAP Notes, you must add all of the values in the column X to activate the highest level of security. However, you MUST note the advanced steps that are required (for example, adjustments in the files sec_info and reg_info) to ensure that the activation is problem-free.

Examples

• You want to activate the functions from Note 1298433 (X=1) but you do not want to activate the functions from Note 1434117. Therefore, you must set gw/reg_no_conn_info to 1.
• If gw/reg_no_conn_info has the value 3, the functions from SAP Notes 1298433 (X=1) and 1434117 (X=2) are activated. To deactivate the functions from Note 1298433, you must set gw/reg_no_conn_info to 2.
• At present, ALL security fixes that have been made up to now are activated with gw/reg_no_conn_info 255 = 128 + 64 + 32 + 16 + 8 + 4 + 2 + 1.

References

• 1848930 – GW: Strong gw/proxy_check
• 1697971 – GW: Enhancement when starting external programs
• 1633982 – Update #1 for Security Note 1444282
• 1504652 – Consulting: Secure Configuration of Application Server ABAP
• 1503858 – Colored lines for sec(-reg) info test in SMGW
• 1465129 – CANCEL registered programs
• 1434117 – Bypassing sec_info without reg_info
• 1425765 – Generating sec_info reg_info
• 1298433 – Bypassing security in reginfo & secinfo

Affected components

• KRNL32NUC (4.6DEXT-4.6DEX2, 6.40-6.40EX2, 7.00-7.01, 7.10-7.20, 7.20EXT)
• KRNL32UC (6.40-6.40EX2, 7.00-7.01, 7.10-7.20, 7.20EXT)
• KRNL64NUC (4.6DEXT-4.6DEX2, 6.40-6.40EX2, 7.00-7.01, 7.10-7.20, 7.20EXT)
• KRNL64UC (6.40-6.40EX2, 7.00-7.01, 7.10-7.20, 7.2L, 7.20EXT)
• KERNEL (4.6D, 6.40, 7.00-7.01, 7.10-7.11, 7.20, 7.2L)