Configure Diagnostics Agents to Check the Solution Manager Server Certificate, SAP security note 2574394

SAP Note 2574394

SAP security note 2574394, "Configure Diagnostics Agents to Check the Solution Manager Server Certificate", is a note. Below are the SAP recommended solution and references.

Description

Authenticate the Solution Manager at the Diagnostics Agent and prevent man-in-the-middle attacks.

This note describes how to set up the connection between Diagnostics Agents and the Solution Manager for the highest possible connection security by using standard TLS mechanisms. It also specifies how to verify the server’s identity using X509 certificates and manage trusted Certificate Authorities (CAs).

Solution

1. Preparing the AS Java

Configure SSL on the AS Java as described in KBA 1770585.
Configure the P4S port for the J2EE NetWeaver Application Server per KBA 2419031. Verify the configuration by following KBA 2268643.

2. Setup Server Authentication

Start the Solution Manager Launchpad by transaction SM_WORKCENTER.
Click the Agents Administration tile to open the Agent Framework application.
Click Agent Admin – All Agents to start the Agent Administration application.
Enable secure P4 connections: go to the Agent Connectivity tab, select MS/P4 SSL for all or selected Diagnostics Agents, and click Apply or Apply for All.
Upload the CA to the Diagnostics Agents: if the server certificate is signed by a CA not known to the agent, upload it to the agent’s key store by going to the Agent Security tab, selecting the relevant Diagnostics Agents, and clicking Update list of trusted CAs.
Enable server authentication: switch maintenance mode on by going to the Agents tab and clicking Maintenance Mode On; enable server verification by going to the Agent Security tab, clicking Refresh, ensuring the P4S Status is green, and clicking Enable SSL Certificate Verification; then switch maintenance mode off by going to the Agents tab and clicking Maintenance Mode Off.
Verify Security State: check the current security state of each Diagnostics Agent in the Agent Security tab under Agent Security Configuration. Server authentication is active if there is a Yes in the corresponding row.

References

Full note on SAP: SAP Support Launchpad note 2574394

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Solution Manager #Diagnostics Agent #TLS #Certificate