Security improvement of HANA authentication, SAP security note 2216869

SAP security note 2216869, "Security improvement of HANA authentication", is a note released on October 13, 2015. Below are the symptom and SAP recommended solution.

Description

Symptom

SAP Security Note 2216869 addresses security enhancements in SAP HANA authentication handling introduced in revision 102. These improvements aim to mitigate risks associated with brute-force attacks and detailed error message disclosures.

Solution

Starting with SAP HANA revision 102, two new parameters have been introduced to enhance security:

• password_lock_for_system_user (default: true) – Locks the SYSTEM user account after a specified number of failed login attempts, as defined in the password policy. This prevents brute-force attacks targeting the SYSTEM user. Setting this parameter to false retains the old behavior, which is not recommended.
• detailed_error_on_connect (default: false) – Returns a generic "authentication failed" message for all failed login attempts, avoiding the disclosure of specific reasons like "user is locked" or "user is deactivated." Setting this parameter to true will enable detailed error messages, which is not recommended.

These parameters can be configured in the [password_policy] section of the indexserver.ini or nameserver.ini files.

CVSS

Score 4.3 / 10 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

References