SAP BASIS

SAP SYSTEM SECURITY PARAMETERS

2012-05-21T08:54:00.001-07:00

Login/no_automatic_user_sapstar
By default, the SAP system is installed with a super user master record called SAP*. If this master record is deleted, SAP allows a user to logon with a password of “PASS” for the SAP* user. To disallow this “illegal” entry, set the value to 1. Recommended value is 1.

Login/failed_to_user_lock
This parameter defines the maximum number of unsuccessful logon attempts before the user is locked by the system. An entry will therefore be recorded in the system log. Recommended value is 6

Login/failed_user_auto_unlock
This parameter activates or deactivates the automatic unlocking of locked users at midnight. It is advisable that the system/user administrator performs the unlocking of locked users. Recommended value is 0

Login/fails_to_session_end
This parameter defines the number of times a user may enter a wrong password before the login session is terminated. Recommended value is 3

Login/gui_auto_logout
This parameter defines the number of inactive seconds after which a user is automatically logged out of the system. Recommended value is 1800 sec

Login/password_expiration_time
This parameter defines the number of days after which a password must be changed. Recommended value is 35 days

Login/min_password_lng
This parameter defines the minimum password length. Recommended value is 8

*Login/min_password digit
This parameter defines the minimum number of digits (0-9) in a password.

*Login/min_password_letters
This parameter defines the minimum number of letters or alphabets (A-Z) in a password.

*Login/min_password_special
This parameter defines the number of special characters in a password. These special characters include (), !, \, $, %,:,’, “, ;, =, &, #, },],{,[, >, <

*Login/min_password_diff
This parameter defines the number of differing characters from previous password.

Rec/client
This parameter activates or deactivates automatic table logging. It is recommended to switch it on, however, resource utilization, table(s) to be logged and log volume should be critically analyzed.

Auth/rfc_authority_check
This parameter defined how S_RFC object is checked during RFC calls. When set to a recommended value of 2, check is active and it performed against SRFC-FUGR.

How to Schedule a Job

2012-05-21T08:28:00.000-07:00

HOW TO SCHEDULE A JOB:

1. Log on to the appropriate SAP instance and client using BATCH_USER.

2. Go to transaction SM36.

3. On the Define Background Job screen, fill in the Job name field with the your job name. Select a Job Class priority of A for High, B for Medium, and C for Low. It is SAP’s recommendation that all client-owned jobs begin with a Z for identification purposes. And most Basis people recommend the next two characters be the initials for the SAP module for which the SAP instance runs. Like ZBC* for a Basis job, and ZHR* for a Human Resources job. Click on the Specify start condition button or press F5.

4. On the Start Time popup, click the immediate button to start the job right away, or click the Date/Time button to specify a date/time in the future for which the job run. Click “on” the Periodic job radio button and then click the Period values button if you want to schedule to job to run on a periodic time basis. Provide the periodic values and click Save back to the main Define Background Job screen.

5. On the main Define Background Job screen, click the Step button.

6. On the Create Step 1 popup, fill in the ABAP program Name and any Variant needed to run the program – you had to have created the variant using BATCH_USER before using it here. Then click Save once more.

7. Back on the Define Background Job screen, check that all the job information is correct and then click the Save button one last time.

After the job was created my recommendation is to check the status of the job after it has already ran.

Creating RFC Connection

2012-05-21T02:55:00.002-07:00

Introduction

This procedure should allow the offshore Basis team to create a RFC connection in any SAP server.

Logon to SAP server
Use Transaction Code SM59
On SM59 screen click on “Create” button
On the new screen, give RFC destination name – Name by which the connection would be identified ( For example QASClinet300 )
Give Connection Type ( 3 for any SAP to SAP communication ) F4 Help will list down all possible types of connections
Give Description for the RFC Connection – Generally the purpose of the connection is mentioned here
Click SAVE
Give IP address/Host name and system number for destination server in Technical Settings tab

Click SAVE
Use “Test Connection” to check RFC.
If Trusted RFC connection is required, give user credentials in “Logon/Security” tab

Creating Local Client Copy

2012-05-21T02:54:00.003-07:00

Introduction

This procedure should allow the offshore Basis team to create a copy of a client locally in the same SAP server.

Logon to SAP server
Use Transaction Code SCC4
Go to change mode
Create a new client, assign client number & description as per request
Logoff from current client.
Login to newly created client using the following credentials :

i. Client Number : Newly created one

ii. User Id : SAP*

iii. Password : PASS

Use Transaction Code SCCL for local client copy
Give reference client for copy and profile as per the request
Use SCC3 T code to monitor progress of Client Copy.

How to do a Remote Client Copy

2012-05-21T02:49:00.002-07:00

Creating Remote Client Copy

Introduction

This procedure should allow the offshore Basis team to create a copy of a client of a Sap server into another SAP Server

Logon to destination SAP server
Use Transaction Code SCC4
Go to change mode
Create a new client, assign client number & description as per request
Logoff from current client.
Login to newly created client in destination SAP server using the following credentials :

i. Client Number : Newly created one

ii. User Id : SAP*

iii. Password : PASS

Use Transaction Code SM59 to create a RFC Connection for client copy if does not exist already.
RFC Connection should have Target Server as Destination and the test results should say “Connection test OK”
Use SCC9 Transaction code to go to client copy screen.
Give profile as per the request.
Select RFC destination created for the purpose for the source client to client copy
Use Transaction code SCC3 for monitoring the progress of client copy

SAP System Monitoring Transactions

2012-05-17T01:01:00.002-07:00

SAP System Monitoring Transaction code

AL08
This transaction code shows a list off all user currently logged on to the SAP system (all app servers).

DB01
This transaction codes will display table locks.

SM12
This transaction code will display the enqueue locks.

Fill in the selection criteria as you want them

SM21
This transaction code is used to see the system log files.

After you have filled in your selection make sure to choose system log, choose, all remote system logs before you hit the read log button.

SM36
This transaction is used to schedule a background job.

SM37
This transaction code is used to display background (or batch) jobs submitted by users.

SM50
This transaction code is used to display all the work processes on the current apps server.

SM51
This transaction code is used to display a list off all the running apps servers. There should be 12 apps servers running at all times.

By double clicking on one off the servers in the list you will then see a listing off all the workprocesses on that server (same as using sm50). Note: you will also connect to that server.

SM66
This transaction code will display a list off all current running work processes on all the apps servers. It doesn’t refresh itself automatically so hit or select the refresh button located at the top.

The list can be sorted by selecting a colum and hitting the sort button located at the top.

ST04
This transaction code will bring up the Informix database overview. It displays information about the current use of the database

BASIS ADMINISTRATOR DAILY ACTIVITIES

2012-05-16T06:23:00.000-07:00

SAP BASIS ADMINISTRATOR DAILY ACTIVITIES

Ø Servers Overview (SM51)

Ø Work process overview (SM50)

Ø Global work process overview (SM66)

Ø Logged-on users of particular server (SM04)

Ø Global logged on active users (AL08)

Ø System logs (SM21) [local or remote logs]

Ø Monitoring ABAP dumps (ST22)

Ø Monitoring r/3 locks and DB locks (SM12, DB01)

Ø Check for the Updates Terminated with Error (SM13)

Ø Update administration (SM14)

Ø Defining and monitoring the background jobs (SM36, SM37)

Ø Spool configuration and management (SP01, SPAD, SP12)

Ø Applying support patches (SPAM, SAINT)

Ø Identify the system performance/system health.

o ST01->system trace

o ST03->workload analysis

Ø TMS configuration (STMS)

Ø To maintain, assigning and missing authorizations

Ø (SU20, SU21, SU22, SU53)

Ø User creations (SU01, SU10)

Ø Applying notes (SNOTE)

Ø Configuring printers (SPAD)

Ø Monitoring Fax and Mails From SAP by using SCOT (SCOT)

Ø Maintaining RFC destinations (SM59)

Ø Creating roles (PFCG)

Ø Generating Reports (SUIM)

Ø Monitoring CUA (SCUA)

Ø Client creation and client copy (SCC4, SCCL, SCC9, SCC8, SCC7)

Ø Logon load balancing (SMLG)

Ø Configuring operational modes and assigning times (RZ04, SM63)

Ø Assisting functional and development team.

Ø Monitoring Interfaces/Batch monitoring (SM35)

Ø Profile Management.

Ø Monitoring Archiving (DB14)

Ø Database monitoring (ST04, DB04)

Ø Switching on the SQL Trace (ST05)

Ø OS Monitor (ST06)

Ø Database statistics (DB02) ->missing indexes

Ø DB12->Database backup-logs

Ø Defining and scheduling Backups and Database optimizing checks.

Sap Security IMP

2012-05-16T06:06:00.007-07:00

Sap Security Q's:

1. how a transaction code works?
2. Can we set any password limitations/exceptions in SAP? If yes, how?
3. What's the basic difference in between SU22 & SU24?
4. What exactly is SU25? What's the significance of it's 2a,2b,2c & 2d sections?
5. Other than SU53, how can you get missing authorisation details?
6. How can we reset the password for 1000 users at one shot? Is it possible?
7. Is it possible to derive a role which is not having any t-code but have some manually entered
authorization objects? If yes, how?
8. Can we reset our self SAP password? Please note, you don't have SU01's authorization.
9. Suppose my Dev system has 3 clients. In one of the client, I'm making some changes in a
tcode. Will the changes get reflected in other client's also? If yes, how?
10. Through which tcode I can do a mass user comparision? What's the daily background job for
the same?
11. What does PRGN_STAT & TCODE_MOD table consist of?
12. What does we check through SM50 & SM51?
13. Which are the necessary objects for controlling the t-code SU01?
14. Can we give display access for DEBUGGING to a user? If yes, how?
15. What are the SAP default Service users & what are their default passwords? What password
does system bydefault generate for these Service User/s while installing a new client within the
system?
16. From where we can create new Authorization field?
17. Is it possible to assign ABAP role to Portal user? If yes, how?
18. How can we gain control over Infotypes?
19. Why we have to generate the profile again after saving the authorization data while role
creation/modification?
20. When does a profile become 11 character string?
21. How can we find out the roles that got directly generated into Production & not imported
from Quality System? Please note, you don't have any Quality user id.
22. How CUA can help from Management standpoint of a Business, having SAP installed?
23.Explain the authorisation concept in detail
24.Explain how config relates to security
25.Explain why SU53 is not always accurate

List of useful reports on SAP users

2012-05-16T05:55:00.000-07:00

List of useful reports on SAP users

RSUSR_SYSINFO_PROFILE          Report cross-system information/profile
RSUSR_SYSINFO_ROLE             Report cross-system information/role
RSUSR_SYSINFO_ZBV              Report cross-system information/CUM
RSUSR000                       Currently Active Users
RSUSR002                       Users by Complex Selection Criteria
RSUSR002_ADDRESS               Users by address data
RSUSR003                       Check the Passwords of Standard Users in All Clients
RSUSR004                       Restrict User Values to the Following Single Profiles and Auth. Ob
RSUSR005                       List of Users With Critical Authorizations
RSUSR006                       Blocked Users and Users with Incorrect Logons
RSUSR007                       Display users with incomplete address data
RSUSR008                       By Critical Combinations of Authorizations at Transaction Start
RSUSR008_009_NEW               List of Users with Critical Authorizations
RSUSR009                       List of Users With Critical Authorizations
RSUSR010                       Executable Transactions ( All Selection Options )
RSUSR011                       Lists of transactions after selection by user, profile or obj.
RSUSR012                       Search authorizations, profiles and users with specified object va
RSUSR020                       Profiles by Complex Selection Criteria
RSUSR030                       Authorizations by Complex Selection Criteria
RSUSR040                       Authorization Objects by Complex Selection Criteria
SUSR050                       Comparisons
SUSR060                       Where-used lists
SUSR060OBJ                    Where-Used List: Authorization Object in Program and Transactions
SUSR061                       Enter Authorization Fields
SUSR070                       Roles by Complex Selection Criteria
SUSR080                       Users by License Data
SUSR100                       Change Documents for Users
SUSR101                       Change Documents for Profiles
SUSR102                       Change Documents for Authorizations
SUSR200                       List of Users According to Logon Date and Password Change
SUSR300                       Set External Security Name for All Users
SUSR301                       Fill non-checking transactions with auth.object S TCODE
SUSR302                       Delete authorization check on object S TCODE from table TSTCA
SUSR500                       User Administration: Compare Users in Central System
RSUSRLOG                       Log Display for Central User Administration
RSUSRSCUC                      CUA: Synchronization of the Company Addresses
RSUSRSUIM                      User Information System

SAP SECURITY TABLES

2012-05-16T05:42:00.003-07:00

List of SAP Security Tables

USR* table contains user master information.
AGR* tables contains data about roles.
USH* table has change documents information.
You can use SQVI or SE16 to get data from these tables.

Table	Description
AGR_1016	Name of the activity group profile
AGR_1016B	Name of the activity group profile
AGR_1250	Authorization data for the activity group
AGR_1251	Authorization data for the activity group
AGR_1252	Organizational elements for authorizations
AGR_AGRS	Roles in Composite Roles
AGR_DEFINE	Role definition
AGR_HIER2	Menu structure information – Customer vers
AGR_HIERT	Role menu texts
AGR_OBJ	Assignment of Menu Nodes to Role
AGR_PROF	Profile name for role
AGR_TCDTXT	Assignment of roles to Tcodes
AGR_TEXTS	File Structure for Hierarchical Menu – Cus
AGR_TIME	Time Stamp for Role: Including profile
AGR_USERS	Assignment of roles to users
USER_ADDR	Address Data for users
USGRP	User groups
USGRPT	Text table for USGRP
USH02	Change history for logon data
USOBT	Relation transaction to authorization object (SAP)
USOBT_C	Relation Transaction to Auth. Object (Customer)
USOBX	Check table for table USOBT
USOBX_C	Check Table for Table USOBT_C
USOBXFLAGS	Temporary table for storing USOBX/T* chang
USR01	User Master Data (runtime data)
USR02	Logon data (password,user name, validity date etc..)
USR04	User master authorization (one row per user)
USR06	License data
USR10	Authorisation profiles (i.e. &_SAP_ALL)
USR11	Text for authorisation profiles
USR12	Authorisation values
USR13	Short text for authorisation
USR40	Table for illegal passwords ( never enter * in this table)
UST04	User profiles (multiple rows per user)
UST10C	Composit profiles (i.e. profile has sub profile)

Securing Custom Programs

2012-05-16T04:16:00.000-07:00

Create custom transaction

2012-05-16T03:40:00.002-07:00

To create custom transaction, it is suggested that you define the naming convention as simple as possible to make sure that users will remember the transaction and do not have to second guess. If a user needs a custom transaction to browse table MARA, you can either call the transaction ZSE16_MARA or simply ZMARA.

Use transaction SE93 to create new transactions and define them as ‘Parameter Transaction’:

Enter SE16 into the transaction field and select the flag the ‘skip initial screen’ field:

On the lower portion of the screen, enter the following information:

Name of screen field: DATABROWSE-TABLENAME

Value:Enter the name of the table you want to browse with SE16

When you save these entries, you will be prompted to add this change to a development class and transport. Use development class ZSEC for security or any other development class recommended by the development team.

Add the changes into a transport request and map the new transaction to authorization object with SU24.

Find out with transaction SE54 to what authorization group the table(s) belongs to:

Once you have identified the authorization group, map the newly created transaction to object S_TABU_DIS with display access only and limited to the authorization group the table belongs to:

Add new transaction to roles

You can now finally add the new transaction to the roles according to the user request

create custom authorization objeccts

2012-05-16T03:16:00.000-07:00

Steps to create authorization field

1. Go to transaction code SU20
2. Click the create new button on the application toolbar.
3. Enter “ZTCODE” in the Field Name and “TCODE” in the Data Element, then hit Enter.
4. Click the save button on the system toolbar.

Next step is to create the authorization class(see #1 in figure 1) and authorization object(see #2 in figure 1).

Steps to create authorization class

1. Go to transaction code SU21
2. Click on the Create button’s drop down icon and select “Object Class”.
3. Enter “ZTRN” on the Object Class field.
4. Give it a description and save it.

Steps to create authorization object

1. Again in SU21, in the list of authorization class(folder icon), click the one that we’ve created(ZTRN).
2. Click on the Create buttodrop down, this time selecting “Authorization Object”.
3. Enter “Z_TCODE” on the Object field and give it a description.
4. On the authorization fields section, enter ACTVT and ZTCODE. ACTVT is used to set and limit the activity of the user, while the ZTCODE is the authorization field that we’ve created earlier which is
responsible for holding a list of tcodes.
5. On the Further Authorization Object Settings, click on “Permitted activities” button. Here we will select the specific activities that we want to be available for our authorization object.
6. As an example, we will select 01(Create), 02(Change), and 03(Display).
7. Save and Exit.

Now we’re done creating our own authorization object, let us now use and assign it to a user.

Steps to create a role:
1. Go to transaction code PFCG.
2. Enter “ZAUTHTEST” on Role field and click the “Single Role” button.
3. Now give it a description, click the save button and click the Authorization tab.
4. Click the “Change Authorization Data” button inside the authorization tab.
5. Then click the “Manually” button on the application toolbar and type in the name of the authorization object that we’ve created earlier(”Z_TCODE”) and press enter.
6. Expand all the nodes, double click on the input field of the Activity and select activity 01 and 02.
7. Enter the tcode of our own abap program in ZTCODE field, in our example I used “ZCOMM” .
8. And also don’t forget to add the S_TCODE authorization object and enter ZCOMM on it’s field.
9. Now Click on the Generate button in the application toolbar and press enter on the pop-up screen.
10. press the back button and assign a specific user on the user tab and click User Comparison button.
11. Now create another role by repeating steps 1 to 9 but this time select activity 03 on step 6.
12. Then assign this 2nd role to another user.

Now let’s implement this authorization in our ABAP program. Let say we have a dialog program(ZCOMM) wherein we have a button on the screen that when clicked, the user will go to the Create/Edit screen(1000) if he’s authorized. On the other hand, he will go to display only screen(2000) if he’s not authorized. To do that, simply add the code below on your program.

  AUTHORITY-CHECK OBJECT ‘Z_TCODE’    “authorization object that we’ve created
      ID ‘ACTVT’ FIELD ‘01′                        “Activity = 01, authorized to create
      ID ‘ZTCODE’ FIELD ‘ZCOMM’.            “tcodes that we wants to check for authorization
  IF sy-subrc EQ 0.
      CALL SCREEN 1000.        “The user is authorized to create
  ELSE.
      CALL SCREEN 2000.        “User is not authorized to create (Display only)
  ENDIF.

Activating and Deactivate Table Logging

2012-05-15T23:49:00.000-07:00

Activate/Deactivate Table Change Logging

Prerequisites

To be able to log the table changes in one client, activate the s ystem profile parameter R ec/ C lient .

To be able to use the logging in transports, you must make the entry r3transoptions = recclient="XXX" in the transport control profile. The entry XXX can have the same value as the profile parameter Rec/Client.

Activate/Deactivate Table Change Logging

1. Choose Tools ® ABAP Workbench ® Development ® Dictionary (SE11) in the initial screen.

2. Enter the name of the table whose log settings you want to check.

3. Choose Change.

The table is displayed. The system may ask you for a change key, because a change to a Dictionary object is a modification in a customer system. Enter the appropriate data.

4. Choose Goto ® Technical Settings.

5. Select/Deselect Log Data Changes checkbox.

All customizing tables are automatically recorded by default.

6. Choose Activate.

If you only save the change, it is not effective.

Deactivate table change logging in the technical settings

To avoid generating too many log entries, you can deactivate the logging for specified tables when making bulk changes.

Deactivating the logging in the technical settings of the table in the Dictionary is not a modification. You do not need to specify a change key.

1. Choose the transaction Dictionary: Technical Settings (SE13).

2. Enter the table name.

3. Choose Change.

4. Cancel Log Data Changes selection.

5. Choose Activate.

You should not deactivate logging for customizing objects.

See SAP note 1916.

2012-05-15T23:37:00.001-07:00

2012-05-15T23:23:00.000-07:00

2012-05-15T23:01:00.002-07:00

Alert Monitoring

AL01 SAP Alert Monitor
AL02 Database alert monitor
AL04 Monitor call distribution
AL05 Monitor current workload
AL16 Local Alert Monitor for Operat.Syst.
AL18 Local File System Monitor
RZ20 CCMS Monitoring

Configuration

FILE Cross-Client File Names/Paths
RZ04 Maintain Operation Modes and Instances
RZ10 Maintenance of Profile Parameters
RZ11 Profile parameter maintenance
SE93 Maintain Transaction Codes
SM63 Display/Maintain Operating Mode Sets
SPRO Customizing: Initial Screen
SWU3 Consistency check: Customizing

Database Administration

DB01 Analyze exclusive lockwaits
DB02 Analyze tables and indexes
DB12 DB Backup Monitor
DB13 DBA Planning Calendar
DB15 Data Archiving: Database Tables
Jobs

SM36 Define Background Job
SM37 Background Job Overview
SM39 Job Analysis
SM49 Execute External OS commands
SM62 Maintain Events
SM64 Release of an Event
SM65 Background Processing Analysis Tool
SM69 Maintain External OS Commands
Monitoring

AL08 Current Active Users
OS01 LAN check with ping
RZ01 Job Scheduling Monitor
RZ03 Presentation, Control SAP Instances
ST01 System Trace
ST02 Setups/Tune Buffers
ST04 Select DB activities
ST05 Performance trace
ST06 Operating System Monitor
ST10 Table call statistics
ST03 Performance, SAP Statistics, Workload
ST07 Application monitor
STAT Local transaction statistics
STUN Performance Monitoring (not available in R/3 4.6x)
Spool

SP01 Output Controller
SP11 TemSe directory
SP12 TemSe Administration
SPAD Spool Administration
Transports

SCC1 Client Copy - Special Selections
SE01 Transport Organizer
SE06 Set Up Workbench Organizer
SE07 CTS Status Display
SE09 Workbench Organizer
SE10 Customizing Organizer
SE11 ABAP/4 Dictionary Maintenance
SE16 Data Browser
SE80 Repository Browser
SM30 Call View Maintenance
SM31 Table Maintenance
STMS Transport Management System

User Administration

PFCG Profile Generator (Activity Group Maintenance)
PFUD User Master Data Reconciliation
SU01 User Maintenance
SU01D User Display
SU02 Maintain Authorization Profiles
SU03 Maintain Authorizations
SU05 Maintain Internet users
SU10 User Mass Maintenance
SMLG Maintain Logon Group
SUPC Profiles for activity groups
SUIM Infosystem Authorizations

Other Transactions

AL22 Dependent objects display
BAOV Add-On Version Information
SA38 ABAP reporting
SE38 ABAP Editor
HIER Internal Application Component Hierarchy Maintenance
ICON Display Icons
WEDI IDoc and EDI Basis
WE02 IDoc display
WE07 IDoc statistics
WE20 Partner profiles
WE21 Port definition
WE46 IDoc administration
WE47 Status Maintenance
$TAB Refreshes the table buffers
$SYNC Refreshes all buffers, except the program buffer

2012-05-15T22:59:00.002-07:00

Administration

AL11 Display SAP Directories
BD54 Maintain Logical Systems
OSS1 Logon to Online Service System
SALE IMG Application Link Enabling
SARA Archive Management
SCC3 Copy Analysis Log
SCC4 Client Administration
SCC5 Client Delete
SCC7 Client Import Post-Processing
SCC8 Client Export
SCC9 Remote client copy
SCCL Local Client Copy
SCU0 Customizing Cross-System Viewer
SICK Installation Check
SM01 Lock Transactions
SM02 System Messages
SM04 User Overview
SM12 Display and Delete Locks
SM13 Display Update Records
SM14 Update Program Administration
SM21 System Log
SM35 Batch Input Monitoring
SM50 Work Process Overview
SM51 List of SAP Servers
SM56 Number Range Buffer
SM58 Asynchronous RFC Error Log
SM59 RFC Destinations (Display/Maintain)
SM66 System Wide Work Process Overview
SAINT SAP Add-on Installation Tool
SPAM SAP Patch Manager (SPAM)
SPAU Display modified DE objects
SPDD Display modified DDIC objects
ST11 Display Developer Traces
ST22 ABAP/4 Runtime Error Analysis
SU56 Analyze User Buffer