Secure configuration of the message server, SAP security note 1421005

SAP security note 1421005, "Secure configuration of the message server", is a installation information note released on 07/17/2013. Below are the symptom and SAP recommended solution.

Description

Symptom

Malicious clients can log on to the message server of your SAP system and assume the identity of an application server. You want to configure the message server in such a way that external clients cannot pose any risks to the operation of the system.

Solution

Systems with kernel version 640 and higher:

Ensure that your system has the correct kernel patch level. The minimum patch level is listed in the following table:

• Kernel release 6.40: Patch level 321
• Kernel release 7.00: Patch level 246
• Kernel release 7.01: Patch level 82
• Kernel release 7.10: Patch level 190
• Kernel release 7.11: Patch level 77
• Kernel release 7.20: Patch level 33

Define an internal message server port (rdisp/msserv_internal). It is essential that this is different from the standard message server port. It is recommended to configure this parameter in the DEFAULT profile of the system to prevent inconsistent settings on different application server instances.

Use the parameter ms/acl_info to define a message server access list. This parameter must refer to a file that the message server can read and that contains access control entries in accordance with Note 821875, section 3. For each host on which an application server can run, ensure that an entry exists that enables this host to access the internal port of the message server.

Systems with kernel version 46D:

Ensure that your system has the correct kernel patch level. A secure connection is available as of kernel patch level 2508.

Define an internal message server port (rdisp/msserv_internal). It is essential that this is different from the standard message server port. It is recommended to configure this parameter in the DEFAULT profile of the system to prevent inconsistent settings on different application server instances.

Set up a packet filter on the host of the message server. Configure the packet filter to permit accesses to the internal port of the message server only from hosts where an application server of the relevant system runs or can run. If no packet filter is available on the host of the message server, set up an external firewall with the relevant rules.

Systems with kernel versions 3.1I, 4.0B, or 4.5B:

In these kernel versions, the functions of the internal message server ports and the access control lists are not available. To ensure that external clients cannot log on to the message server of your SAP system and can output as application servers, comply with the following rules:

• Implement a firewall that protects the server network or the central instance from external accesses.
• Ensure that external clients and servers cannot bypass the firewall to access the message server host (e.g., via a VPN or SAProuter).
• In the firewall, open only those TCP ports that require clients or external servers to access the dispatcher or the gateway of the central instance. Typically, these are the TCP ports 32<nn> and 33<nn> (where <nn> stands for the instance number).
• Open the TCP ports required for other server services on the host of the central instance.
• Do not open the port of the message server; external clients and servers should not be able to access this. Use the parameter rdisp/msserv to define this port.
• Test the firewall by attempting to connect from a client to the message server port of the central instance via telnet. This connection attempt should fail.

These measures mean that you lose load balancing for clients and external servers. To ensure that connections of clients, other servers, and external servers continue to work, deactivate load balancing for these connections and configure the connection directly to one of the application servers of the system.

References