Secure configuration of ICM for the ABAP application server, SAP security note 1616535

SAP security note 1616535, "Secure configuration of ICM for the ABAP application server". Below are the symptom and the SAP recommended solution.

Description

Symptom

You want to make the configuration of the Internet Communication Manager (ICM) for the ABAP application server more secure.

Solution

Use the following settings to reduce the server information to a minimum:

• Set the parameter is/HTTP/show_server_header to FALSE. When you change this, the "Server:" header field is no longer set in HTTP responses.
• Set the parameter is/HTTP/show_detailed_errors to FALSE. After you do this, the system does not return any details about the error to the client.

Alternatively, configure your own error pages to ensure that the system does not provide the technical reason for the error to the end user; to do this, set icm/HTTP/error_templ_path = /usr/sap/B6M/D13/data/icmerror and create your own error pages.

For additional security improvements when using the ABAP application server:

• Always keep the level of the ABAP application server current.
• Use only HTTPS for communication between the browser and the application server.

Reason and prerequisites

If errors occur, the ICM and the ABAP application server provide the user with detailed information about the server version and the possible reason for the error. Malicious users can use this information for attacks.