Dynamic Derivation of System ID from Application Server Directory (AL11)

[ashish_dey84sap]

Background

There are certain cases where other non-SAP applications will upload the file as Inbound in Application Server which needs to be loaded into BW. We have dedicated path created in AL11 where these Inbound files are placed and to be more precise, we define the directory path name based on System Landscape (DEV, QAT, PRD). This is done for the purpose to know exactly in which system either Inbound files are placed, or Outbound files are generated via OHD or any Custom Abap Programs.

For Example, the AL11 path name in DEV Environment is /usr/sap/actual/temp/ABD/test.txt

The AL11 path name in Quality Environment is /usr/sap/actual/temp/ABQ/test.txt

The AL11 path name in Production Environment is /usr/sap/actual/temp/ABP/test.txt

Here the System ID for DEV Environment is ABD

Here the System ID for Quality Environment is ABQ

Here the System ID for Production Environment is ABP

Scenario -1 (Info-package Routines for loading Inbound Flat Files)

Loading Data into BW via Dynamic Path in Info-package level where System ID is derived dynamically based on the System Landscape.

Below is the Syntax to dynamically derive the System ID.

CONCATENATE '/usr/sap/actual/temp/' sy-sysid '/test.txt' INTO p_filename.

Scenario -2 (Open Hub Destinations)

Generating the Outbound files via Open Hub Destination in Application Server path. Below is the Syntax of the Physical path under the Logical File Path Definition to dynamically derive the System ID. T. code is FILE.

/usr/sap/actual/temp/<SYSID>/<FILENAME>

Scenario -3 (Operating System Command)

Sometimes we need to execute a Script which is placed in the Application Server via System Command. This System Command is created in T. Code – SM69. It's being used to create/maintain external operating system commands.

Below is the Syntax to dynamically derive the System ID in Operating System Command definition to locate the exact path.

/usr/sap/actual/temp/$/SAPSYSTEMNAME//scripts/test.sh

[zeno_rummler]

Did you do a Threat Modelling Workshop for that?
The whole process is not clear to me.
Placing files on OS and also executing scripts (maybe from uploaded files?) looks risky to me. Some questions coming to my mind right now: Who can upload files? How do you protect the path? Who can execute scripts? Who delivers scripts? Why is it on OS level?