topic Re: SAP R/3 security problem in Application Development and Automation Discussions

SAP R/3 security problem

Former Member — Sat, 12 May 2007 09:49:57 GMT

It is clear that the security will happen when you dropped the normal “SAP” & “DDIC” account because the reserved SUPER account with password "PASS" will activate. So, while you lost the normal “SAP” & “DDIC” account, you should notice others people and re-create that as soon as possible.

How to fix the security problem?

Re: SAP R/3 security problem

Former Member — Sun, 13 May 2007 19:09:03 GMT

If you delete DDIC user then it will stay deleted. It will not recreate itself.

As SAP* is a hardcoded user, if you delete it, it will recreate itself with a commonly known password. To prevent this, you need to set profile parameter (via RZ10) login/no_automatic_user_sap* = 1

This will stop SAP* automatically creating itself.

There are a number of other things you should do to restrict SAP*

Change default password

Lock the ID

Remove all profiles (SAP_ALL, SAP_NEW)

Assign to group SUPER

DDIC should also have the password changed from default and be locked when it's not being used.

Re: SAP R/3 security problem

antonio_steinhuser — Mon, 14 May 2007 09:29:07 GMT

Additional you should activate the Security Audit Log for these Super-User with Transaction SM18-SM19.

Gruß

Toni

Re: SAP R/3 security problem

Former Member — Mon, 14 May 2007 10:21:20 GMT

Hi,

If the user master record belonging to user SAP* is deleted, it is possible to re-log on with SAP* and initial password PASS. SAP* then has the following attributes:

- The user has all authorization, as authorization check

cannot be executed.

- You cannot change the standard password PASS.

Using profile parameter login/no_automatic_user_sapstar,

you can deactivate the special attributes of SAP*.

So login to RZ11--->open the parameter(login/no_automatic_user_sapstar) and change the default Value to 1.

Valid entries, formats, areas : 0, 1

0: Automatic user SAP* is permitted

1: Automatic user SAP* is deactivated

Hope it helps.

Please award points if it is useful.

Thanks & Regards,

Santosh

Re: SAP R/3 security problem

Former Member — Mon, 14 May 2007 12:40:11 GMT

Hi,

Restricting SAP* and DDIC user

1) First we change the password of SAP* and DDIC user in SU01 (T-code)

2) As SAP is a hard coded user whenever SAP user deleted, it is possible to re-log on with SAP* and initial password PASS.

Using profile parameter login/no_automatic_user_sapstar, you can deactivate the special attributes of SAP*.

3) To avoid automatic generation SAP* password we set a profile parameter login/no_automatic_user_sapstar=1(Automatic user SAP* is deactivated) in RZ10 (t-code).

4) Profile parameter will be effected only after restarting the sap system , so we restart sap system.

regards,

kanthi