Skip to content

Commit 8aa6eb4

Browse files
akula86akula86
committed
small update
1 parent 0ebdc2a commit 8aa6eb4

1 file changed

Lines changed: 55 additions & 35 deletions

File tree

‎tutorials/hxe-ua-configure-security/hxe-ua-configure-security.md‎

Lines changed: 55 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ tags: [ tutorial>beginner, topic>HXE, products>sap-hana,-express-edition ]
1515
How to perform security tasks to ensure that your security settings are not known outside your organization. You will learn how to apply the HXE license to ensure your installation keeps working after the default grace period expires.
1616

1717
### Time to Complete
18-
**15 Min**.
18+
**15-20 Min**.
1919

2020
---
2121

@@ -33,7 +33,7 @@ If you are using the SAP HANA Studio eclipse plugin, you can do the following.
3333
5. Make a note of the Hardware Key value.
3434

3535
#### Order your license key
36-
1. Go to [sap.com/minisap](http://sap.com/minisap) and fill out all required information.
36+
1. Go to [SAP Sneak Preview License Key Request](http://sap.com/minisap) page and fill out all required information.
3737
2. For System ID, select HXE.
3838
3. For Hardware Key, enter the hardware key value you recorded earlier.
3939
4. Submit the form. The license key is emailed to you.
@@ -59,7 +59,7 @@ After confirmation, the properties page refreshes with your new license informat
5959
3. Copy or otherwise record the value returned for `HARDWARE_KEY`
6060

6161
#### Order your license key
62-
1. Go to [sap.com/minisap](http://sap.com/minisap) and fill out all required information.
62+
1. Go to [SAP Sneak Preview License Key Request](http://sap.com/minisap) page and fill out all required information.
6363
2. For System ID, select HXE.
6464
3. For Hardware Key, enter the hardware key value you recorded earlier.
6565
4. Submit the form. The license key is emailed to you.
@@ -85,49 +85,69 @@ After confirmation, the properties page refreshes with your new license informat
8585
5. Proceed to **Change the SSFS Master Keys**.
8686

8787

88-
### Change the SSFS Master Keys
89-
1. Log on to the HANA system as **`hxeadm`** and shut the system down using the `sapcontrol` program:
90-
**/`usr/sap/hostctrl/exe/sapcontrol` -nr 00 –function Stop**
88+
## <a name="ssfsKeys">Change the SSFS Master Keys</a>
89+
The secure stores in the file system (SSFS) used by SAP HANA are protected by unique master keys, generated during installation or update. If you installed HXE from an OVA, then it shares master keys with other HXE systems. We recommend that you change the master keys immediately after setup to ensure that your master keys are not known outside your organization. For more information on changing the master keys, see the [Change the SSFS Master Keys](https://help.sap.com/saphelp_hanaplatform/helpdata/en/58/1593c48739431caaccc3d2ef55c23f/frameset.htm) topic in the *SAP HANA Administration Guide*.
90+
91+
1. Log on to the HANA system as `hxeadm` and shut the system down using the `sapcontrol` program:
92+
93+
`/usr/sap/hostctrl/exe/sapcontrol -nr 00 -function Stop`
94+
9195
2. Re-encrypt the master key of the instance SSFS:
92-
**`RSEC_SSFS_DATAPATH`=/`usr`/sap/`HXE`/`SYS`/`global`/`hdb`/security/`ssfs`
93-
export `RSEC_SSFS_DATAPATH`
94-
`RSEC_SSFS_KEYPATH=/usr/sap/HXE/SYS/global/hdb/security/ssfs rsecssfx changekey` $(`rsecssfx generatekey -getPlainValueToConsole`)**
95-
3. Add following to the end of /`usr`/sap/`HXE`/`SYS`/`global`/`hdb`/custom/`config`/`global.ini`:
96-
**[cryptography]
97-
`ssfs_key_file_path = /usr/sap/HXE/SYS/global/hdb/security/ssfs`**
96+
97+
`RSEC_SSFS_DATAPATH=/usr/sap/HXE/SYS/global/hdb/security/ssfs`
98+
99+
`RSEC_SSFS_KEYPATH=/usr/sap/HXE/SYS/global/hdb/security/ssfs rsecssfx changekey $(rsecssfx generatekey -getPlainValueToConsole)`
100+
101+
3. Add the following entry to the `global.ini` file using a text editor. (HANA, express edition, comes with the `vi` and `vim` text editors.) The `global.ini` file is located here: `/usr/sap/HXE/SYS/global/hdb/custom/config/global.ini`
102+
103+
Add or edit the cryptography section with the following value.
104+
105+
`[cryptography]`
106+
107+
`ssfs_key_file_path = /usr/sap/HXE/SYS/global/hdb/security/ssfs`
108+
98109
4. Re-encrypt the system PKI SSFS with a new key - HDB start:
99-
**`RSEC_SSFS_DATAPATH=/usr/sap/HXE/SYS/global/security/rsecssfs/data`
100-
`export RSEC_SSFS_DATAPATH RSEC_SSFS_KEYPATH=/usr/sap/HXE/SYS/global/security/rsecssfs/key rsecssfx changekey $(rsecssfx generatekey -getPlainValueToConsole)`**
110+
111+
`RSEC_SSFS_DATAPATH=/usr/sap/HXE/SYS/global/security/rsecssfs/data`
112+
113+
`RSEC_SSFS_KEYPATH=/usr/sap/HXE/SYS/global/security/rsecssfs/key rsecssfx changekey $(rsecssfx generatekey -getPlainValueToConsole)`
114+
101115
5. Restart the system:
102-
**/`usr/sap/hostctrl/exe/sapcontrol` -nr 00 -function Start**
103116

104-
For more information, see the [Change the SSFS Master Keys](https://help.sap.com/saphelp_hanaplatform/helpdata/en/58/1593c48739431caaccc3d2ef55c23f/frameset.htm) topic in the *SAP HANA Administration Guide*.
117+
`/usr/sap/hostctrl/exe/sapcontrol -nr 00 -function Start`
118+
119+
120+
## Change the Root Key
121+
SAP HANA generates unique root keys on installation. If you installed HXE from an OVA, then it shares a root key with other HXE systems. We recommend that you change the root key of the internal data encryption service to ensure it is not known outside your organization. For more information on this topic, see the [Change the Root Key of the Internal Data Encryption Service](https://help.sap.com/saphelp_hanaplatform/helpdata/en/8f/bb69c47c224b3292ba078684f176e3/frameset.htm) topic in the *SAP HANA Server Installation and Update Guide*.
105122

106-
### Change the Root Key
107-
Change the root key of your installation.
108123
1. Log on to the HANA system as **`hxeadm`** and shut the system down using the `sapcontrol` program:
109-
**/`usr/sap/hostctrl/exe/sapcontrol` –nr 00 –function Stop**
110-
2. Generate a new root encryption key using the **`hdbnsutil`** program:
111-
**cd /`usr/sap/HXE/HDB00/exe`
112-
./`hdbnsutil` -`generateRootKeys` --type=`DPAPI`**
124+
125+
`/usr/sap/hostctrl/exe/sapcontrol -nr 00 -function Stop`
126+
127+
2. Generate a new root encryption key using the `hdbnsutil` program:
128+
129+
`cd /usr/sap/HXE/HDB00/exe`
130+
131+
`./hdbnsutil -generateRootKeys --type=DPAPI`
132+
113133
3. Restart the system:
114-
**/`usr/sap/hostctrl/exe/sapcontrol` -nr 00 -function Start**
134+
135+
`/usr/sap/hostctrl/exe/sapcontrol -nr 00 -function Start`
136+
115137
4. Reset the consistency information in the SSFS using the `hdbcons` program:
116-
**cd /`usr/sap/HXE/HDB00/exe`
117-
./`hdbcons "crypto ssfs resetConsistency`" -e `hdbnameserver`**
118-
5. You have 20 seconds to rerun the command again to completely rewrite `ssfs` consistency information:
119-
**./`hdbcons` -e `hdbnameserver` "crypto `ssfs resetConsistency`"**
138+
139+
`cd /usr/sap/HXE/HDB00/exe`
140+
141+
`./hdbcons "crypto ssfs resetConsistency" -e hdbnameserver`
142+
143+
5. After running the `hdbcons` command you have 20 seconds to rerun the command again to completely rewrite `ssfs` consistency information:
144+
145+
`./hdbcons "crypto ssfs resetConsistency" -e hdbnameserver`
146+
120147
6. Change all application keys so that they are encrypted with the new root key by using SAP HANA studio or SAP HANA HDBSQL:
121-
**ALTER SYSTEM APPLICATION ENCRYPTION CREATE NEW KEY**
122148

123-
For more information, see the [Change the Root Key of the Internal Data Encryption Service](https://help.sap.com/saphelp_hanaplatform/helpdata/en/8f/bb69c47c224b3292ba078684f176e3/frameset.htm) topic in the *SAP HANA Server Installation and Update Guide*.
149+
`hdbsql -u system -p <YourPassword> -d SystemDB "ALTER SYSTEM APPLICATION ENCRYPTION CREATE NEW KEY"`
124150

125-
### Deactivate the SYSTEM user
126-
1. Log in as SYSTEM user to create a user with the USER ADMIN system privilege:
127-
**/`usr`/sap/HXE/HDB00/`exe/hdbsql -d SystemDB` -u SYSTEM -p <SYSTEM_PWD> "CREATE USER `MyAdminUser` PASSWORD <`MyAdminUserPwd`> NO `FORCE_FIRST_PASSWORD_CHANGE`;"
128-
/`usr`/sap/HXE/HDB00/`exe/hdbsql` -d `SystemDB` -u SYSTEM -p <SYSTEM_PWD> "GRANT USER ADMIN to `MyAdminUser` WITH ADMIN OPTION ;" **
129-
2. Log in as **`MyAdminUser`** to deactivate SYSTEM:
130-
**/`usr`/sap/HXE/HDB00/`exe`/`hdbsql` -d `SystemDB` -u `MyAdminUser` -p <`MyAdminUserPwd`> "ALTER USER SYSTEM DEACTIVATE USER NOW;"**
131151

132152
## Next Steps
133153
- Select a tutorial from the [Tutorial Navigator](http://go.sap.com/developer/tutorial-navigator.html) or the [Tutorial Catalog](http://go.sap.com/developer/tutorials.html)

0 commit comments

Comments
 (0)