{"id":830,"date":"2024-02-16T21:31:40","date_gmt":"2024-02-16T19:31:40","guid":{"rendered":"https:\/\/1coach.by\/wp\/?page_id=830"},"modified":"2024-02-16T21:51:12","modified_gmt":"2024-02-16T19:51:12","slug":"s4hana-1909","status":"publish","type":"page","link":"https:\/\/1coach.by\/wp\/s4hana-1909\/","title":{"rendered":"S4HANA 1909"},"content":{"rendered":"\n<\/colgroup>\n<\/colgroup>\n<\/colgroup>\n<\/colgroup>\n<\/colgroup>\n<\/colgroup>\n<\/colgroup>\n<\/colgroup>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Area<\/span><\/b><\/td>\nType of setting<\/span><\/b><\/td>\nName<\/span><\/b><\/td>\nStorage<\/span><\/b><\/td>\nDescription<\/span><\/b><\/td>\nRelevant SAP Note<\/span><\/b><\/td>\nSAP Note URL<\/span><\/b><\/td>\nNew recommended value<\/span><\/b><\/td>\nImpact to operations<\/span><\/b><\/td>\nMitigation of impact<\/span><\/b><\/td>\nRevert back method<\/span><\/b><\/td>\n<\/tr>\n
Authorizations<\/span><\/td>\nProfile parameter<\/span><\/td>\nauth\/check\/calltransaction<\/span><\/td>\nDEFAULT.PFL<\/span><\/td>\nBehavior of authority check during call transaction: Controls how CALL TRANSACTION statements in all programs react regarding missing entries in SE97 \/ table TCDCOUPLES. If not set to 3, authorization checks are not properly enforced.<\/td>\n515130<\/td>\n515130<\/a><\/span><\/u><\/td>\n3<\/span><\/td>\nIn special cases, “jumps” from within one transaction into another may fail due to missing authorizations.<\/span><\/td>\nIn case transactions cannot be started from other transactions, add relevant transactions to the role menu of relevant roles. This will add necessary authorizations automatically.
\nIn case authorization check should not be executed if a transaction is called from another transaction, maintain relevant entries in transaction SE97.
\nEntries in transaction SE97 only need to be maintained in case necessary, no \u201cpreventive\u201d maintenance required.<\/td>\n		Comment out profile parameter or set to value 2 (kernel default).<\/span><\/td>\n<\/tr>\n
Authorizations<\/span><\/td>\nProfile parameter<\/span><\/td>\nauth\/object_disabling_active<\/span><\/td>\nDEFAULT.PFL<\/span><\/td>\nEnables to globally switch off authorization checks for selected authorization objects (prerequisite for transaction AUTH_SWITCH_OBJECTS). If not set to “N”, a global deactivation would be possible.<\/td>\n2926224<\/td>\n2926224<\/a><\/span><\/u><\/td>\nN<\/span><\/td>\nThe disabling of authorization objects is strictly forbidden. This feature can no longer be used during operations.<\/span><\/td>\n – <\/span><\/td>\nComment out profile parameter or set to value Y (kernel default).<\/span><\/td>\n<\/tr>\n
Authorizations<\/span><\/td>\nProfile parameter<\/span><\/td>\nauth\/rfc_authority_check<\/span><\/td>\nDEFAULT.PFL<\/span><\/td>\nExecution option for the RFC authority check: Controls the behavior of enforced authentication and authorization checks when RFC function modules are called from remote. If not set to 6, an information disclosure vulnerability exists for unauthenticated users.<\/td>\n2216306<\/td>\n2216306<\/a><\/span><\/u><\/td>\n6<\/span><\/td>\nIn certain cases, dumps may occur in the system where interfaces try to retrieve information without authentication. In transaction SM59, when calling certain functions like “Unicode test” for a destination without a user, a logon will be prompted.<\/span><\/td>\nGrant S_RFC authorization object for function group “SRFC” to affected interface users and administrative staff.<\/span><\/td>\nComment out profile parameter or set to value 1 (kernel default).<\/span><\/td>\n<\/tr>\n
Server infrastructure<\/span><\/td>\nProfile parameter<\/span><\/td>\ngw\/reg_no_conn_info<\/span><\/td>\nDEFAULT.PFL<\/span><\/td>\nSpecific security-related additional functions for the RFC gateway are activated depending on which bits are set in this bitmask. If not set to 255, not all security checks may be properly enforced in the RFC gateway.<\/td>\n2776748<\/td>\n2776748<\/a><\/span><\/u><\/td>\n255<\/span><\/td>\nIn very rare situations, connects from 3rd party systems to the RFC gateway may fail. This will then affect interfaces requiring the 3rd party service.<\/span><\/td>\nDebug failure scenario and ask vendor of 3rd party interface to improve RFC gateway connection mechanism.<\/span><\/td>\nComment out profile parameter or set to value 1 (kernel default).<\/span><\/td>\n<\/tr>\n
Server infrastructure<\/span><\/td>\nProfile parameter<\/span><\/td>\ngw\/rem_start<\/span><\/td>\nDEFAULT.PFL<\/span><\/td>\nThis setting specifies with which method an RFC server might be started on OS level from an external endpoint. If not set to “DISABLED”, attempts to utilize an improper or even insecure OS logon method (like RSH) might be possible.<\/td>\n2776748<\/td>\n2776748<\/a><\/span><\/u><\/td>\nDISABLED<\/span><\/td>\nIn very rare situations, connects from 3rd party systems to the RFC gateway may fail. This will then affect interfaces requiring the 3rd party service.<\/span><\/td>\nDebug failure scenario and ask vendor of 3rd party interface to improve RFC gateway connection mechanism.<\/span><\/td>\nComment out profile parameter.<\/span><\/td>\n<\/tr>\n
Logon & SSO<\/span><\/td>\nProfile parameter<\/span><\/td>\nicf\/set_HTTPonly_flag_on_cookies<\/span><\/td>\nDEFAULT.PFL<\/span><\/td>\nThis parameter is used to set the attribute HTTPonly for ICF cookies. If not set to 0, javascript code running in the browser may inappropriately access sensitive cookies.<\/td>\n1277022<\/td>\n1277022<\/a><\/span><\/u><\/td>\n0<\/span><\/td>\nCustom coding may intentionally utilize access to cookies for application operation. Such access will be blocked, possible disrupting a seamless user experience.<\/span><\/td>\nChange coding of the application to not make use of ICF cookie access from within javascript.<\/span><\/td>\nComment out profile parameter or set to value 3 (kernel default).<\/span><\/td>\n<\/tr>\n
Monitoring & Logging<\/span><\/td>\nProfile parameter<\/span><\/td>\nicm\/HTTP\/logging_0<\/span><\/td>\nDEFAULT.PFL<\/span><\/td>\nAn access log can be created with this parameter in which accesses from the Intranet and Internet are logged. If not set properly, important information may be missing in logs.<\/td>\n2788140<\/td>\n2788140<\/a><\/span><\/u><\/td>\nPREFIX=\/,LOGFILE=http_%y_%m.log,MAXFILES=2,MAXSIZEKB=50000,SWITCHTF=month, LOGFORMAT=%t %a %u1 \\”%r\\” %s %b %Lms %{Host}i %w1 %w2<\/span><\/td>\nLogging functions will be enabled\/enhanced. No impact other that disc space consumption is expected. However, if a SIEM system is active that consumes log entries, the corresponding interface may be impacted.<\/span><\/td>\nMonitor disk space properly. Adapt SIEM log consumer.<\/span><\/td>\nComment out profile parameter.<\/span><\/td>\n<\/tr>\n
Monitoring & Logging<\/span><\/td>\nProfile parameter<\/span><\/td>\nicm\/HTTP\/logging_client_0<\/span><\/td>\nDEFAULT.PFL<\/span><\/td>\nAn access log can be created with this parameter in which outgoing ICM calls to the Intranet and Internet are logged. If not set properly, important information may be missing in logs.<\/td>\n2788140<\/td>\n2788140<\/a><\/span><\/u><\/td>\nPREFIX=\/,LOGFILE=http_client_%y_%m.log,MAXFILES=2,MAXSIZEKB=50000,SWITCHTF=month, LOGFORMAT=%t %a %u1 \\”%r\\” %s %b %Lms %{Host}i<\/span><\/td>\nLogging functions will be enabled\/enhanced. No impact other that disc space consumption is expected. However, if a SIEM system is active that consumes log entries, the corresponding interface may be impacted.<\/span><\/td>\nMonitor disk space properly. Adapt SIEM log consumer.<\/span><\/td>\nComment out profile parameter.<\/span><\/td>\n<\/tr>\n
Monitoring & Logging<\/span><\/td>\nProfile parameter<\/span><\/td>\nicm\/security_log<\/span><\/td>\nDEFAULT.PFL<\/span><\/td>\nThis parameter is used to control the output of the security log from the ICM and SAP Web Dispatcher. If not set properly, important information may be missing in logs.<\/td>\n2788140<\/td>\n2788140<\/a><\/span><\/u><\/td>\nLOGFILE=dev_icm_sec_%y_%m,LEVEL=3,MAXFILES=2,MAXSIZEKB=50000,SWITCHTF=month<\/span><\/td>\nLogging functions will be enabled\/enhanced. No impact other that disc space consumption is expected. However, if a SIEM system is active that consumes log entries, the corresponding interface may be impacted.<\/span><\/td>\nMonitor disk space properly. Adapt SIEM log consumer.<\/span><\/td>\nComment out profile parameter.<\/span><\/td>\n<\/tr>\n
Logon & SSO<\/span><\/td>\nProfile parameter<\/span><\/td>\nlogin\/disable_cpic<\/span><\/td>\nDEFAULT.PFL<\/span><\/td>\nIf this parameter is not set to 1, incoming connections of the type CPIC are not rejected. Incoming connections of the type RFC are not affected.<\/td>\n2926224<\/td>\n2926224<\/a><\/span><\/u><\/td>\n1<\/span><\/td>\nPure, native CPIC communication (which is obsolete) will no longer work.<\/span><\/td>\nChange old CPIC interfaces to properly make use of standard RFC calls.<\/span><\/td>\nComment out profile parameter or set to value 0 (kernel default).<\/span><\/td>\n<\/tr>\n
Logon & SSO<\/span><\/td>\nProfile parameter<\/span><\/td>\nlogin\/password_downwards_compatibility<\/span><\/td>\nDEFAULT.PFL<\/span><\/td>\nThis parameter is used to control whether the system stores password hashes also in an obsolete, outdated format for compatibility reasons. If not set to 0, outdated hashes will be maintained that can be easily cracked by adversaries that are able to access the password hash storage tables.<\/td>\n1023437<\/td>\n1023437<\/a><\/span><\/u><\/td>\n0<\/span><\/td>\nWhen running a central user administration (CUA) still making use of outdated hashes, the CUA central system has to implement the same technique. If this is not done properly, user password distribution and logon may fail.<\/span><\/td>\nHandle CUA system first. Set the profile parameter to value 3 and observe system behavior in the system log, set new complex password for affected users. <\/span><\/td>\nComment out profile parameter or set to value 1 (kernel default).<\/span><\/td>\n<\/tr>\n
Logon & SSO<\/span><\/td>\nProfile parameter<\/span><\/td>\nlogin\/password_hash_algorithm<\/span><\/td>\nDEFAULT.PFL<\/span><\/td>\nThe hash value calculation can be improved with this parameter to make dictionary and brute force attacks more difficult.<\/td>\n2140269<\/td>\n2140269<\/a><\/span><\/u><\/td>\nencoding=RFC2307, algorithm=iSSHA-512, iterations=15000, saltsize=256<\/span><\/td>\nWhen running a central user administration (CUA), the CUA central system has to implement the same technique. If this is not done properly, user password distribution and logon may fail.<\/span><\/td>\nHandle CUA system first. <\/span><\/td>\nComment out profile parameter.<\/span><\/td>\n<\/tr>\n
Monitoring & Logging<\/span><\/td>\nProfile parameter<\/span><\/td>\nms\/HTTP\/logging_0<\/span><\/td>\nDEFAULT.PFL<\/span><\/td>\nThis parameter is used to control the output of the log from the message server. If not set properly, important information may be missing in logs.<\/td>\n2794817<\/td>\n2794817<\/a><\/span><\/u><\/td>\nPREFIX=\/,LOGFILE=$(DIR_LOGGING)\/ms-http-%y-%m-%d.log%o,MAXFILES=7,MAXSIZEKB=10000,SWITCHTF=day,LOGFORMAT=%t %a %u %r %s %b %{Host}i<\/span><\/td>\nLogging functions will be enabled\/enhanced. No impact other that disc space consumption is expected. However, if a SIEM system is active that consumes log entries, the corresponding interface may be impacted.<\/span><\/td>\nMonitor disk space properly. Adapt SIEM log consumer.<\/span><\/td>\nComment out profile parameter.<\/span><\/td>\n<\/tr>\n
Monitoring & Logging<\/span><\/td>\nProfile parameter<\/span><\/td>\nms\/http_logging<\/span><\/td>\nDEFAULT.PFL<\/span><\/td>\nThis parameter is used to activate the log from the message server. If not set properly, important information may be missing in logs.<\/td>\n2794817<\/td>\n2794817<\/a><\/span><\/u><\/td>\n1<\/span><\/td>\nLogging functions will be enabled\/enhanced. No impact other that disc space consumption is expected. However, if a SIEM system is active that consumes log entries, the corresponding interface may be impacted.<\/span><\/td>\nMonitor disk space properly. Adapt SIEM log consumer.<\/span><\/td>\nComment out profile parameter or set to value 0 (kernel default).<\/span><\/td>\n<\/tr>\n
Logon & SSO<\/span><\/td>\nProfile parameter<\/span><\/td>\nrdisp\/gui_auto_logout<\/span><\/td>\nDEFAULT.PFL<\/span><\/td>\nAutomatic user logoff after inactivity time is controlled with this setting. If not set, no auto logout will occour, making access to applications by improper personnel more likely.<\/td>\n–<\/td>\n–<\/td>\n1H<\/span><\/td>\nDialog users will be logged off after one hour of inactivity. This may impact long running processes that are run in the foreground.<\/span><\/td>\nCreate background jobs for long running processes.<\/span><\/td>\nComment out profile parameter or set to value 0 (kernel default).<\/span><\/td>\n<\/tr>\n
Business data integrity<\/span><\/td>\nProfile parameter<\/span><\/td>\nrdisp\/vbdelete<\/span><\/td>\nDEFAULT.PFL<\/span><\/td>\nThe parameter specifies the duration in days, after which an update request is deleted. At the end of this period, the update requests are deleted irrespective of their status. If the parameter has not value 0, update requests could potentially deleted that are still required by the business to ensure the integrity of the data.<\/td>\n2441606<\/td>\n2441606<\/a><\/span><\/u><\/td>\n0<\/span><\/td>\nBroken update requests may pile up and slow down the system in the end if not handled in a timely manner.<\/span><\/td>\nClean up update requests in SM13 frequently and adapt application \/ system setup to avoid updater issues.<\/span><\/td>\nComment out profile parameter or set to value 50 (kernel default).<\/span><\/td>\n<\/tr>\n
RFC interface<\/span><\/td>\nProfile parameter<\/span><\/td>\nrfc\/callback_security_method<\/span><\/td>\nDEFAULT.PFL<\/span><\/td>\nPermit or deny execution of RFC callbacks in accordance with configured allowlist and write corresponding entry in Security Audit Log. If not set to 3, improper RFC callback attempts are still allowed.<\/td>\n2678501<\/td>\n2678501<\/a><\/span><\/u><\/td>\n3<\/span><\/td>\nIntended RFC callbacks (e.g. executed by custom coding) that are not properly covered by RFC callback allowlisting in SM59 of calling system (which receives the callback) will be denied. This then leads to dumps and application disruption.<\/span><\/td>\nMonitor RFC callback attempts in Security Audit Log (SM19 \/ RSAU_CONFIG) and maintain allowlist in SM59 on affected destinations.<\/span><\/td>\nComment out profile parameter or set to value 1 (kernel default).<\/span><\/td>\n<\/tr>\n
RFC interface<\/span><\/s><\/td>\nProfile parameter<\/span><\/s><\/td>\nrfc\/ext_debugging<\/p>\n

Parameter was removed, refer to SAP Note 2909642<\/span><\/s><\/td>\n

DEFAULT.PFL<\/span><\/s><\/td>\nActivate external (HTTP) debugging for RFC. If not set to 0, debugging is possible.<\/s><\/td>\n668256<\/s><\/td>\n\u00a0<\/span><\/u><\/td>\n0<\/span><\/s><\/td>\nRFC debugging is fully disabled.<\/span><\/s><\/td>\nThis is a dynamic parameter, if debugging is required, it can be enabled (transaction RZ11).<\/span><\/s><\/td>\nComment out profile parameter or set to value 3 (kernel default).<\/span><\/s><\/td>\n<\/tr>\n
Logon & SSO<\/span><\/td>\nProfile parameter<\/span><\/td>\nrfc\/reject_expired_passwd<\/span><\/td>\nDEFAULT.PFL<\/span><\/td>\nControls whether logon with expired or initial password via RFC is allowed or not. If not set to 1, users with a non-productive password are able to remotely call RFC function modules.<\/td>\n2579165
\n1591259<\/td>\n		2579165<\/a><\/span><\/u><\/td>\n1<\/span><\/td>\nHandling of password setup and expiry for technical users may be impacted. Interfaces may stop working if passwords are expired or initial.<\/span><\/td>\nCheck password status in transaction SUIM, refresh affected passwords\/users.<\/span><\/td>\nComment out profile parameter or set to value 0 (kernel default).<\/span><\/td>\n<\/tr>\n
Monitoring & Logging<\/span><\/td>\nProfile parameter<\/span><\/td>\nwdisp\/add_xforwardedfor_header<\/span><\/td>\nDEFAULT.PFL<\/span><\/td>\nEnables the inclusion of the client IP address the HTTP X-Forwarded-For header. If not set to “TRUE”, the client IP address will not be added, making the determination of request routes for applications harder and reducing useful log information.<\/td>\n2788140<\/td>\n2788140<\/a><\/span><\/u><\/td>\nTRUE<\/span><\/td>\nNone.<\/span><\/td>\n – <\/span><\/td>\nComment out profile parameter or set to value “FALSE” (kernel default).<\/span><\/td>\n<\/tr>\n
Monitoring & Logging<\/span><\/td>\nCustomizing<\/span><\/td>\nSecurity Audit Log configuration<\/span><\/td>\nRSAU_CONFIG<\/span><\/td>\nConfigures an initial setup of the Security Audit Log. If not configured, the Security Audit Log will not record any security events.<\/td>\n2838480<\/td>\n2838480<\/a><\/span><\/u><\/td>\nIf the Security Audit Log does not contain any active filters, recommended filter settings as of SAP Note 2676384 are set up.<\/span><\/td>\nLogging functions will be enabled\/enhanced. No impact other that disc space consumption is expected. However, if a SIEM system is active that consumes log entries, the corresponding interface may be impacted.<\/span><\/td>\nMonitor disk space properly. Adapt SIEM log consumer.<\/span><\/td>\nDelete new filter configuration in transaction RSAU_CONFIG.<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"

Area Type of setting Name Storage Description Relevant SAP Note SAP Note URL New recommended value Impact to operations Mitigation of impact Revert back method Authorizations Profile parameter auth\/check\/calltransaction DEFAULT.PFL Behavior of authority check during call transaction: Controls how CALL TRANSACTION statements in all programs react regarding missing entries in SE97 \/ table TCDCOUPLES. If … <\/p>\n","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"telegram_tosend":false,"telegram_tosend_message":"","telegram_tosend_target":0,"footnotes":""},"_links":{"self":[{"href":"https:\/\/1coach.by\/wp\/wp-json\/wp\/v2\/pages\/830"}],"collection":[{"href":"https:\/\/1coach.by\/wp\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/1coach.by\/wp\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/1coach.by\/wp\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/1coach.by\/wp\/wp-json\/wp\/v2\/comments?post=830"}],"version-history":[{"count":2,"href":"https:\/\/1coach.by\/wp\/wp-json\/wp\/v2\/pages\/830\/revisions"}],"predecessor-version":[{"id":838,"href":"https:\/\/1coach.by\/wp\/wp-json\/wp\/v2\/pages\/830\/revisions\/838"}],"wp:attachment":[{"href":"https:\/\/1coach.by\/wp\/wp-json\/wp\/v2\/media?parent=830"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}