SAP Netweaver SAL incorrect logging of addresses, SAP security note 2190621

SAP security note 2190621, "SAP Netweaver SAL incorrect logging of addresses", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

Incorrect logging of IP addresses in Security Audit Logging (SAL). Specifically, the system logs the terminal IP address instead of the last routed (peer) IP address, which can lead to inaccurate audit trails.

Solution

Introduce a new profile parameter rsau/log_peer_address.

• Default Value: 0 (no change in behavior)
• Recommended Value: 1 (logs the last routed IP address instead of the terminal IP address)

Steps to Implement:

• Set the Profile Parameter: Add or update the parameter rsau/log_peer_address to 1 in your system profile. Note: Setting this parameter may cause warnings in transaction RZ10. These warnings can be safely ignored, and the parameter can be maintained.
• Apply the Kernel Patch: Download and apply the kernel patch referenced in this SAP Note to ensure the solution is fully implemented.

Reason and prerequisites

In network environments that include proxies or NAT routers, SAL incorrectly logs the client’s terminal IP address instead of the router’s IP address. Since the router’s IP address cannot be manipulated by the client, it provides a more reliable source for auditing purposes.

CVSS

Score 4.3 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References