Use of the Security Audit Log
Configuration and installation of SAP systems
User authentication is usually performed by entering a user name and password. This information is called user credentials and should only be known to the user, so that no third party can gain access to the system under a false identity. This post explains how a user's password protection can be circumvented and how to prevent it. SAP system legacy data The login data of a user, including password, are saved in the USR02 database table. However, the password is not in plain text, but encrypted as a hash value. For each user there are not only one but up to three generated password hashes. Different algorithms are used to calculate these values, but only the Salted SHA1 can be considered sufficiently safe. Table deduction USR02 The secure password hash is located in the fifth column of the pictured table deduction with the heading Password hash value. The corresponding data field in the column is called PWDSALTEDHASH. Weak Password Hash Risks You have a good and working permission concept that ensures that no processes or data can be manipulated or stolen. A potential attacker now has the ability to read out your database with the password hashes. The hash values are calculated using password crackers, which are available on the Internet at home, and the attacker now has a long list of user credentials. To damage your system, the user will now search for the appropriate permissions and perform the attack under a false identity. Identifying the actual attacker is virtually impossible. Check if your system is vulnerable too Your system generates the weak hash values if the login/password_downwards_compatibility profile parameter has an unequal value of 0.
In the beginning, in our company the installation and management of the systems were dealt with by the functional consultants/consultants of the respective systems. The CRM consultant was responsible for the SAP CRM system, the SRM consultant for the SAP SRM, etc.
SUGR Maintain user groups
The task of SAP Basis is to ensure trouble-free, interoperable and portable (mobile) operation of SAP systems in the company. Interoperable means that independent and heterogeneous IT systems can work together.
People tend to forget how important this element of the architecture is. The setup involved often proves to be especially important for companies looking to implement the SAP system for the first time.
For administrators, a useful product - "Shortcut for SAP Systems" - is available in the SAP basis area.
The uncompressed support packages are displayed in bytes.
Our SAP Basis trainings and courses originate from our practical work in companies.