Monday, 21 May 2012

SAP SYSTEM SECURITY PARAMETERS

Login/no_automatic_user_sapstar
By default, the SAP system is installed with a super user master record called SAP*. If this master record is deleted, SAP allows a user to logon with a password of “PASS” for the SAP* user. To disallow this “illegal” entry, set the value to 1. Recommended value is 1.

Login/failed_to_user_lock

This parameter defines the maximum number of unsuccessful logon attempts before the user is locked by the system. An entry will therefore be recorded in the system log. Recommended value is 6

Login/failed_user_auto_unlock
This parameter activates or deactivates the automatic unlocking of locked users at midnight. It is advisable that the system/user administrator performs the unlocking of locked users. Recommended value is 0

Login/fails_to_session_end

This parameter defines the number of times a user may enter a wrong password before the login session is terminated. Recommended value is 3

Login/gui_auto_logout
This parameter defines the number of inactive seconds after which a user is automatically logged out of the system. Recommended value is 1800 sec

Login/password_expiration_time

This parameter defines the number of days after which a password must be changed. Recommended value is 35 days

Login/min_password_lng
This parameter defines the minimum password length. Recommended value is 8

*Login/min_password digit
This parameter defines the minimum number of digits (0-9) in a password.

*Login/min_password_letters
This parameter defines the minimum number of letters or alphabets (A-Z) in a password.

*Login/min_password_special

This parameter defines the number of special characters in a password. These special characters include (), !, \, $, %,:,’, “, ;, =, &, #, },],{,[, >, <

*Login/min_password_diff
This parameter defines the number of differing characters from previous password.

Rec/client

This parameter activates or deactivates automatic table logging. It is recommended to switch it on, however, resource utilization, table(s) to be logged and log volume should be critically analyzed.

Auth/rfc_authority_check
This parameter defined how S_RFC object is checked during RFC calls. When set to a recommended value of 2, check is active and it performed against SRFC-FUGR.