Clarification and preparation of measures for the use of the Security Audit Log
SAP Basis Consulting
A degree in computer science is usually required and is now almost obligatory. If you have completed training as a computer scientist, you can continue your education to become an SAP Basis Administrator and position yourself particularly well on the job market. Integrata CegosEine also offers training to become an SAP Basis Administrator.
From a purely technical point of view, each generated authorization role contains a profile from which a user receives the actual authorization objects and authorization characteristics. If this profile is outdated or not assigned at all, the user will not have all the authorization objects contained in the authorization role. Incidentally, the problem arises particularly frequently after role transports: If an authorization role is changed in the development system and then transported to the production system, the current profile is not automatically assigned to the users with the respective role. A user comparison must therefore be performed here.
Preparation of full access to SAP systems and solutions in case of disasters (High Availability/Disaster Recovery)
The security of an SAP system requires protection against unauthorised access, e.g. through the secinfo and reginfo files. A cleanly implemented authorisation concept protects against attacks within the SAP system. However, it is also possible to attack your SAP system via the network. Through the RFC Gateway Server, your system communicates with external servers and programmes. One particularly effective way to protect against this are so-called Access Control Lists (ACL). Find out what this is and how you can use it to better protect your SAP system. The SAP Standard offers different approaches for gate protection. All methods combined can provide even greater safety. For example, it is possible to use Access Control Lists (ACL) to monitor exactly which external programmes and which hosts can communicate with the gateway. Another option is to configure the gateway to support Secure Network Communication (SNC). Finally, there are various security parameters for the gateway. This article focuses on the use of ACL files such as secinfo and reginfo files. What is an ACL? Access control lists are files in which permitted or prohibited communication partners can be recorded. For the gateway to use these ACL files, parameters must be set in the default profile of the SAP system and of course the files must be maintained accordingly. With the help of logs and traces, which can be configured for this purpose, a precise investigation can be made in advance of the activation, which connections currently run via the gateway. This allows them to prevent important applications with which your system communicates from being blocked by the ACL files. The rules in the ACL files are read from top to bottom of the gateway to decide whether to allow a communication request. If none of the rules matches the requesting programme, it will be blocked. Network-based ACL The network-based ACL file contains permitted and prohibited subnets or specific clients.
The following list explains the steps in the order they are performed by SPAM: PROLOGUE This step will check if you are eligible to play Support Packages. CHECK_REQUIREMENTS In this step, different requirements for inserting are checked, e.g. the login of the transport control programme tp to your system. DISASSEMBLE In this step, the data files are unpacked from the corresponding EPS packages and placed in the transport directory. ADD_TO_BUFFER In this step, the queue is placed in the transport buffer of your system. TEST_IMPORT This step checks whether there are any objects that are overridden during the commit and are in unreleased tasks. IMPORT_OBJECT_LIST In this step, the object lists for the support packages that are in the queue are fed into the system. OBJECTS_LOCKED_? This step checks to see if there are any objects that are overwritten during the commit and that are in unreleased jobs. SCHEDULE_RDDIMPDP In this step the transport daemon (programme RDDIMPDP) is planned. ADDON_CONFLICTS_? This step checks to see if there are conflicts between objects in the queue and add-ons installed. SPDD_SPAU_CHECK This step will check if a modification match (transactions SPDD/SPAU) is necessary. DDIC_IMPORT In this step, all ABAP Dictionary objects of the queue are imported. AUTO_MOD_SPDD This step checks whether modifications to ABAP Dictionary objects can be adjusted automatically. RUN_SPDD_? This step prompts you to customise your modifications to ABAP Dictionary objects by calling the transaction SPDD. IMPORT_PROPER In this step, all repository objects and table entries are fed. Then actions such as distribution, implementation, activation and generation take place. AUTO_MOD_SPAU This step checks whether modifications can be adjusted automatically. RUN_SPAU_?
Tools such as "Shortcut for SAP Systems" complement missing functions in the SAP basis area.
Further information on SAP Security in addition to the article can be found here.
On www.sap-corner.de you will also find useful information about SAP basis.
The service will now restart and all instances should be green.