Зашифровано ли ваше соединение SAP GUI? Может ли кто-нибудь подслушать ваши пароли
Доброе утро! Тема безопасности всегда актуальна и поэтому сегодня предоставлю вам интересную статью от Yuksel AKCINAR.
Шифрование клиента SNC
Приятно было узнать что мы можем обезопасить связь SAP GUI.
Большинство клиентов не знают об этом и используют SAP GUI без шифрования в текстовом режиме.
SNC Client Encryption — это инструмент, который можно использовать для шифрования без платы за лицензию.
Я настроил наши системы ABAP и SAP GUI для шифрования с помощью SAP Notes, руководств, справочных страниц и scn-блогов.
Как сказал в своем блоге Филипп Хофмайстер, у меня также возникли трудности с поиском правильного руководства по настройке SNC Client Encryption.
Вы можете перейти к ссылкам, чтобы получить подробную информацию.
Я хочу поделиться о том как я сделал настройку шаг за шагом.
Примечания и ссылки, которые необходимо прочитать;
(Этот Notes имеет правильное руководство по настройке — настройка SNC Client Encryption с CCL.pdf — это я понял в последнее время)
Я попытался перейти на страницу справки, но к сожалению это было непонятно и не было пошаговым руководством. По этой причине я потерял некоторое время. Наконец я нашел верный гайд, прикрепленный к примечанию 2185235, который очень прост в использовании и полезен. Нет необходимости в других документах.
Configurations Steps которые я выполнил:
1 — Патч ядра с 7.20 до 7.22 SP 23 (так как CommonCryptoLib 8.4.30 доступен в ядре).
Версия ядра Kernel для моей системы была низкой, поэтому я обновил ядро на 7.22, что включает условие CommonCryptoLib версии 8.4.30 или выше.
2 — Проверьте и примените примечания 1561161, 1580808, 1616598, 1617641 если применимо.
3 — Создал пользователя AD
Я попросил системных администраторов создать пользователя со следующими свойствами.
Имя входа: SNC-CE-USER
Фамилия: клиентский клиент шифрования
Пароль: <Определить пароль>
Название службы: SAP / SNC-CE-USER
Пользователь не может изменить пароль
Пароль nnever истекает
Вы можете проверить SPN с помощью команды ниже.
setspn -Q SAP / SNC-CE-ПОЛЬЗОВАТЕЛЬ
SNC_setspn.jpg
4 — Определение параметров SNC
Используя транзакцию RZ10, вы должны определить ниже параметры для включения SNC
snc / permit_insecure_start = 1
snc / accept_insecure_gui = 1
snc / accept_insecure_rfc = 1
snc / accept_insecure_cpic = 1
snc / r3int_rfc_qop = 8
snc / r3int_rfc_secure = 0
snc / data_protection / use = 3
snc / data_protection / min = 2
snc / data_protection / max = 3
snc / force_login_screen = 0
snc / identity / as = p: CN=SNC-CE-USER@MYDOMAIN.COM
snc / gssapi_lib = D: \ usr \ sap \ <SID> \ DVEBMGS00 \ exe \ sapcrypto.dll
5 — Создайте свой Kerberos keytab
Войдите в систему SAP Systems с помощью sidadm и с помощью cmd создайте keytab
set SECUDIR = D: \ usr \ sap \ <SID> \ DVEBMGS00 \ sec
sapgenpse keytab -p SAPSNCSKERB.pse -x <пароль для PSE> -y <пароль пользователя SNC-CE-USER> -a SNC-CE-USER@MYDOMAIN.COM
/wp-content/uploads/2016/01/sapgenpse_1_876711.jpg
sapgenpse seclogin -p SAPSNCSKERB.pse -x <пароль для PSE> -O SAPService <SID>
/wp-content/uploads/2016/01/sapgenpse_2_876712.jpg
Вы можете проверить PSE с помощью команды ниже;
sapgenpse keytab -p SAPSNCSKERB.pse -x <пароль для PSE> -nopsegen
/wp-content/uploads/2016/01/sapgenpse_3_876713.jpg
Вы можете проверить были ли учетные данные успешно созданы с помощью команды ниже
sapgenpse seclogin -l
/wp-content/uploads/2016/01/sapgenpse_4_876714.jpg
6 — Перезапустите систему SAP
При перезапуске системы SAP, если возникнут проблемы с keytab то система SAP не запускается. Тогда вы можете изменить параметр snc/enable на 0 и перезапустить систему. После исправления несоответствий вам необходимо снова включить SNC и перезагрузить систему.
Вы можете проверить файлы трассировки dev_wX для устранения проблем с SNCinit.
7- Установите SNC Client Encryption на хостах Windows для клиентов SAP GUI для Windows.
Вы устанавливаете программу шифрования клиента SNC в системах клиентов.
SNC_CE.jpg
Вы можете проверить установлен ли параметр среды SNC_LIB после установки.
(т.е. SNC_LIB = C: \ Program Files (x86) \ SAP \ FrontEnd \ SAP GUI \ Encryption \ secgss.dll )
8 — Настройте SAP GUI для Windows, чтобы использовать шифрование клиента SNC.
SNC_GUI.jpg
9 — Проверьте подключение GUI
При подключении к системе вы можете увидеть символ блокировки в левом нижнем углу экрана графического интерфейса, как показано ниже.
SNC_encrypted.jpg
Если вы увидели эту блокировку в своих графических интерфейсах то вам удалось настроить SNC Client Encryption.
Ссылки, которые я посетил, и некоторые знания для устранения неполадок
SNC Client Encryption
SNC Client Encryption is an optional feature of SAP GUI and SAP NetWeaver technology platform. This software component enables users to protect communication between SAP GUI and SAP NetWeaver Application Server (AS) ABAP. The component also enables encryption for RFC clients, such as BEx Query Designer.
SNC Client Encryption uses Secure Network Communications (SNC) to provide encryption and secure communication for the communication channel between the client and the AS ABAP. This protects the business user operating the client from eavesdroppers, who seek to capture or manipulate information, such as logon data or business data.
In a standard setup, users enter their user name and password into the logon screen of the SAP GUI. SAP GUI transfers data, such as user names and passwords, through the network without encryption.
SNC Client Encryption only offers encryption. To enable single sign-on (SSO), we offer SAP NetWeaver Single Sign-On. SAP NetWeaver Single Sign-On centralizes and greatly simplifies the way users log on to systems and applications in your IT landscape. Seamlessly integrated into your existing authentication processes, it offers enhanced security through state-of-the-art technology. But that’s not the only benefit SAP NetWeaver Single Sign-On has to offer. Reduce your operating costs by eliminating password-related helpdesk calls, and improve user productivity — more than enough reasons to start thinking about implementing a single sign-on solution in your company.
SNC Client Encryption Installation steps
- Create the technical Active Directory User for your AS ABAP system and assign a Service Principal Name (SPN)
NOTE
SPN name format : SAP/YourServiceUser
Active Directory user need to be made domain member
NOTE
The new CommonCryptoLib (SAPCRYPTOLIB) Version 8.4.30 (or higher) is fully compatible with previous versions of SAPCRYPTOLIB beginning with AS ABAP Kernel 7.20 PL88. In addition, CommonCryptoLib adds features of SAP Single Sign-On 2.0 Secure Login Library.
You must not use CommonCryptoLib if you are running Kernel releases prior to 7.20 PL88, as CommonCryptoLib is not fully compatible with such old releases. Use SAPCRYPTOLIB 5.5 PL38 in such cases.
Common configuration problems
Active Directory user
Service User does not exist
User is not logged in to domain (no domain user)
Service User has no Service Principal Name or it has been set with invalid syntax Mandatory form is "SAP/YourServiceUser
Multiple Service Principal Name (SPN) in same Active Directory was found
Keytab and credential
Keytab password and service user password does not match
Wrong PSE name was used (SAPSNCSKERB.pse or pse.zip is mandatory)
SPN was used instead of Service User UPN to create the keytab
Credential was set for a different system user
SAPGUI SNC configuration
SNC User Name is configured in transaction SU01
Client side problems
User running the SNC Client encryption is not a member of domain
Error: No credentials were supplied (see client side trace for more details)
Create trace
1. Create the trace file directory in either %HOMEDRIVE%%HOMEPATH%\sec or C:\sec.
2. Create the file sec_log_file_filename.txt in the trace file directory. This file sets the name format for the trace files.
3. Enter the name format for the trace files in the sec_log_file_filename.txt file. Use the following format: <Path_to_Trace_File_Directory>\log-%.PID.%.txt
This creates a log file in the sec directory with the process ID replacing %.PID.% in the name. The AS ABAP creates multiple work processes, so including the process ID in the name avoids parallel access to the same file by all processes.
4. Create the sec_log_file_level.txt in the trace file directory.This file sets the trace level.
5. To start the trace, enter a trace value as a single digit in the trace level file according to the table below.
Snc client encryption что это за программа
Completing the CAPTCHA proves you are a human and gives you temporary access to the web property.
What can I do to prevent this in the future?
If you are on a personal connection, like at home, you can run an anti-virus scan on your device to make sure it is not infected with malware.
If you are at an office or shared network, you can ask the network administrator to run a scan across the network looking for misconfigured or infected devices.
Another way to prevent getting this page in the future is to use Privacy Pass. You may need to download version 2.0 now from the Chrome Web Store.
Cloudflare Ray ID: 71aa34b0286f9ba4 • Your IP : 82.102.23.104 • Performance & security by Cloudflare
SNC encryption made easy: SAP security even without SSO
To secure and encrypt customer networks, SAP offers the SNC (Secure Network Communications) interface with which users can log in to SAP systems without having to enter a user name or password. In the standard system, SAP login credentials are transmitted in clear text. The SNC interface routes calls through the SAP Cryptographic Library, to encrypt all communications between the SAP GUI and the SAP server. This enables secure individual logins for SAP.
SNC implementation without SSO, but with SSL – is that possible?
The minimum level of security that SNC offers is “Authentication”. If only this parameter is used, the system verifies the identity of the communication partners and encrypts the user’s login credentials (user name and password). At higher levels, data transmission and data package content can also be encrypted with SNC.
This represents an important step toward technical protection of SAP systems.
In the following, I’ll explain how SNC-encrypted communication can be set up without incurring the additional costs of implementing single sign-on (SSO).
Secure login using the SAP Secure Login Client
The SAP Secure Login Client can be used to log in to the SAP system. The Secure Login Client is a client application that provides security tokens (Kerberos and X.509 technology) for a variety of applications. It uses the functions of the SAP Cryptographic Library (CommonCryptoLib).
Secure login supports users with authentication, among other features, using the authentication mechanism of the Windows domain (Active Directory server) or an SSL (Secure Sockets Layer) certificate.
With SAP Single Sign-On 3.0, users can log in with the SAP GUI using encrypted communications, but without needing single sign-on.
- The Secure Login Client from SAP Single Sign-On 3.0 or higher is running on the client PCs.
- The back-end systems are running SAP NetWeaver Application Server for ABAP with the CommonCryptoLib 8.5 or higher from the SAP Cryptographic Library.
The following options are available for configuring the Secure Login Client:
- Activation of legacy compatibility mode. This is an SNC-protected login on the server side. Legacy compatibility mode is available with CommonCryptoLib 8.5.x and lower and SAPCRYPTOLIB 5.5.5.
- Activation of the Secure Login Client, to select an authentication method (smart mode), if most of the application servers use the SAP Cryptographic Library CommonCryptoLib 8.5 or higher. This option is recommended by SAP, because the Secure Login Client always selects the best authentication method.
- Encryption can only be implemented permanently for all users or a group of users with SNC.
- Users can switch to encryption manually for the login with SNC.
Clarification of Secure Login Client license issue with SAP
To clarify use of the Secure Login Client, we asked the following question of SAP: “The SNC encryption to be implemented will only use the SAP Cryptographic Library of the Secure Login Client. SSO is not planned. Will costs be incurred anyway?”
The answer from SAP: “This case involves secure client encryption. This component can be used at no additional cost. Please note, however, that this approach provides ‘encryption only’. It cannot be used to implement single sign-on.”
If we follow this argument to its logical conclusion, this means the Secure Login Client can be used free of charge, as long as SSO isn’t used.
How the implementation of SNC with SSL encryption works
An existing SSL certificate for https is used for SCN connection encryption. As a result, no connection to the Microsoft AD (Kerberos) is needed. Encryption is ensured by the SSL certificate in PSE and in the SNC Library.
In this scenario, however, it is important to monitor certificate expiration dates and renew them in time. If the certificate is not renewed in time, SNC cannot be used until successful recertification.
How to prepare ABAP properly: In the SAP, transaction STRUST is used to “copy” the PSE file from the SSL server entry to the SNC SAPCryptolib entry. As such, the SNC name for the SAPGUI entry is determined from the SLL server certificate, for example, “p:CN=<SID>.<customer>.de, OU=SAP Basis, O=<service provider>, L=Frankfurt am Main, C=DE”.
In SAP GUI Logon, SNC must be activated for the individual users and the SNC name “p:CN=<SID>.<customer>.de, OU=SAP Basis, O=<service provider>, L=Frankfurt am Main, C=DE” must be entered.
This assumes that all options have been set correctly and that SNC is fully functional on the server side. The user can log in using an encrypted network connection,
which is identified by the “closed padlock” icon in the lower right corner of the SAP GUI.
Advantages of SNC encryption
SNC encryption via SSL offers the following advantages:
- No connection to the Microsoft AD required, which means lower maintenance and administration effort.
- External workers and service providers can only use SNC if a certificate with a recognized ROOT CA is used and Client Encryption 2.0 or Secure Login Client is installed on the front end.
- Only the SAP GUI has to be adjusted.
- No additional costs for encryption software, because the https certificate is already available.
- Often policy-compliant, since the SSL certificate is valid for an SAP/ABAP application.
- No follow-up work on SNC parameters or certificates needed after system copies.
- The SAP Secure Login Client can be used.
If SSL is used, however, the certificate expiration date must be monitored, because SNC cannot be used with an expired certificate.
An SNC implementation is possible at reasonable cost, even without a grand solution including SSO. In this context, we recommend using SNC with SSL encryption, which reduces the required implementation effort even more.
Do you want to learn more about technical safeguards for your SAP systems? Feel free to visit our SAST SOLUTIONS website or just get in touch: sast@akquinet.de
Matthias Anstötz (SAP Security Consultant, SAST SOLUTIONS)