You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: adoc/OS_Security_Hardening_Guide_for_SAP_HANA_SLES12.adoc
+9-9Lines changed: 9 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -73,7 +73,7 @@ All remaining network ports are closed. The firewall has a broad range of featur
73
73
It is available as RPM package and can be downloaded from SUSE.
74
74
75
75
Remote Disk Encryption::
76
-
Starting with SUSE Linux Enterprise Server for SAP Applications 12 SP2, SUSE introduced a new feature called *Remote Disk Encryption*.
76
+
Starting with SUSE Linux Enterprise Server for SAP applications 12 SP2, SUSE introduced a new feature called *Remote Disk Encryption*.
77
77
Classical Disk Encryption - available for years – always required a passphrase entered during boot.
78
78
That prevented its use in many setups because each boot needed a manual step.
79
79
Remote Disk Encryption removes this manual step as it allows the encryption keys to be stored safely on a remote key server and to be automatically used during system boot.
@@ -139,7 +139,7 @@ These settings are based on the recommendations of a security audit, which was p
139
139
140
140
NOTE: Read the SUSE Linux Enterprise Server Security Guide and the SUSE Linux Enterprise Server Hardening Guide for additional measures
141
141
(see https://documentation.suse.com/). +
142
-
(Choose "SUSE Linux Enterprise Server" instead of "SUSE Linux Enterprise Server for SAP Applications".
142
+
(Choose "SUSE Linux Enterprise Server" instead of "SUSE Linux Enterprise Server for SAP applications".
143
143
144
144
For each setting the following details are provided:
145
145
@@ -829,7 +829,7 @@ image::hana_firewall_traffic_flow.svg[alt="Example of a SAP HANA firewall networ
829
829
830
830
Installation
831
831
~~~~~~~~~~~~
832
-
The SAP HANA firewall is available in the repositories for SUSE Linux Enterprise Server for SAP Applications 12.
832
+
The SAP HANA firewall is available in the repositories for SUSE Linux Enterprise Server for SAP applications 12.
833
833
It extends the SuSEFirewall2 configuration by adding rulesets.
834
834
----
835
835
zypper install HANA-Firewall
@@ -853,7 +853,7 @@ The configuration can be done:
853
853
* by the YaST SAP HANA Firewall module (`yast hanafirewall`) or
854
854
* on the command line with `hana-firewall`
855
855
856
-
Section 9.2 https://documentation.suse.com/sles-sap/12-SP4/single-html/SLES4SAP-guide/#sec-s4s-configure-firewall-hana[Configuring HANA-Firewall] of the SUSE Linux Enterprise Server for SAP Applications Guide describes the SAP HANA-Firewall YaST module and lists some advice regarding multi-tenant HANA databases.
856
+
Section 9.2 https://documentation.suse.com/sles-sap/12-SP4/single-html/SLES4SAP-guide/#sec-s4s-configure-firewall-hana[Configuring HANA-Firewall] of the SUSE Linux Enterprise Server for SAP applications Guide describes the SAP HANA-Firewall YaST module and lists some advice regarding multi-tenant HANA databases.
857
857
858
858
Prerequisites
859
859
^^^^^^^^^^^^^
@@ -1073,7 +1073,7 @@ All data processed by SAP HANA can contain sensitive information that need to be
1073
1073
Depending on the version the data volume, redoing log files or database backups can be encrypted by SAP HANA itself.
1074
1074
For details consult the SAP HANA Security Guide (https://help.sap.com).
1075
1075
1076
-
If the internal encryption of SAP HANA should not or cannot be used, you can encrypt directories containing sensitive data via Remote Disk Encrypting available in SUSE Linux Enterprise Server for SAP Applications.
1076
+
If the internal encryption of SAP HANA should not or cannot be used, you can encrypt directories containing sensitive data via Remote Disk Encrypting available in SUSE Linux Enterprise Server for SAP applications.
1077
1077
When using the internal encryption, the various encryption keys are stored on disk in the SSFS which is located by default in `<home-of-sidadm>/.hdb/<host-identity>/SSFS_HDB.DAT`.
1078
1078
The SSFS itself is encrypted with the SSFS master key, normally located in $DIR_GLOBAL/hdb/security/ssfs/, which is protected only by file permissions.
1079
1079
To protect this key or the SSFS, Remote Disk Encrypting can help. It will not store any key of SAP HANA directly, but can encrypt the part of the file system where the keys are located.
@@ -1083,7 +1083,7 @@ It allows to store the encryption keys safely on a remote key server.
1083
1083
To mount the device, the host contacts the key server on a TLS secured connection. From there, it retrieves the necessary keys automatically to unlock the data.
1084
1084
The key server should by any means be a dedicated security-hardened and protected system, since anyone with access to this system can retrieve the keys and decrypt the data.
1085
1085
1086
-
The SUSE Linux Enterprise Server for SAP Applications guide describes the setup of client and server in section 10 https://documentation.suse.com/sles-sap/12-SP4/single-html/SLES4SAP-guide/#cha-s4s-configure-cryptctl[Encrypting Directories Using cryptctl].
1086
+
The SUSE Linux Enterprise Server for SAP applications guide describes the setup of client and server in section 10 https://documentation.suse.com/sles-sap/12-SP4/single-html/SLES4SAP-guide/#cha-s4s-configure-cryptctl[Encrypting Directories Using cryptctl].
1087
1087
1088
1088
1089
1089
Minimal operating system package election
@@ -1111,7 +1111,7 @@ Depending on the actual setup, further packages might be required.
1111
1111
1112
1112
Required installation patterns and packages
1113
1113
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1114
-
The required software for SAP HANA is described in 'SUSE Linux Enterprise Server 12.x for SAP Applications Configuration Guide for SAP HANA' attached to SAP note '1944799 - SAP HANA Guidelines for SLES Operating System Installation'.
1114
+
The required software for SAP HANA is described in 'SUSE Linux Enterprise Server 12.x for SAP applications Configuration Guide for SAP HANA' attached to SAP note '1944799 - SAP HANA Guidelines for SLES Operating System Installation'.
1115
1115
1116
1116
The document lists the necessary patterns and additional software packages.
1117
1117
@@ -1159,8 +1159,8 @@ zypper lr
1159
1159
1160
1160
This command lists the available software repositories of a SUSE Linux Enterprise Server instance.
1161
1161
The output should show the update channel for the particular Service Pack of SUSE Linux Enterprise Server 12.
1162
-
On SUSE Linux Enterprise Server for SAP Applications 12, the update channels for the Service Pack of
1163
-
SUSE Linux Enterprise Server for SAP Applications and for the High Availability Extension should be available.
1162
+
On SUSE Linux Enterprise Server for SAP applications 12, the update channels for the Service Pack of
1163
+
SUSE Linux Enterprise Server for SAP applications and for the High Availability Extension should be available.
1164
1164
1165
1165
There are many ways to install new patches, and also to selectively install only the security updates.
1166
1166
The most common way to install security updates only is to execute the following commands:
0 commit comments