Skip to Content

Configure SAP HANA 2.0, express edition Security

Beginner
5 min.
SAP HANA, express edition, Tutorial, Beginner
Your SAP HANA, express edition installation has several preconfigured security settings. Before using SAP HANA, express edition, complete these security tasks.
You will learn
  • How to perform security tasks to ensure that your security settings are not known outside your organization

Prerequisites

  • Step 1

    Installing SAP HANA 2.0, express edition installs a permanent 32 GB license automatically. No license configuration is required.

  • Step 2

    Every user who downloads SAP HANA, express edition receives the same default encryption settings. Use the change_key.sh utility to change encryption automatically.

    Important: SAP recommends you run change_key.sh immediately after installation to ensure your security settings are not known outside your organization.

    The change_key.sh utility:

    • Changes the secure stores in the file system (SSFS) master keys. The script re-encrypts the master key of the instance SSFS and re-encrypts the system PKI SSFS with a new key.

    • Changes the encryption root keys. The script generates new keys, backs them up, and activates them.

  • Step 3

    Follow this procedure to run the script:

    At the command prompt, type:

    /usr/sap/HXE/home/bin/change_key.sh
  • Step 4

    The script prompts you for:

    Prompt Description
    HANA Instance Number Enter the default (90).
    System user password You specified this password when you were prompted for HANA database master password.
    Root key backup password Enter a strong password. The root key backup password is required to securely back up the root keys and subsequently restore the backed-up root keys during data recovery. For information on root key backup, see Root Key Backup.
    Root key directory A directory to store the root key backup password securely. Choose a non-temporary directory. For example /usr/sap/HXE/HDB90.
  • Step 5

    Enter Y when prompted. The script runs. Wait for the hxehost:hxeadm> prompt to return (approximately 30 seconds).

    New data will now be encrypted with the new keys.

  • Step 6

    SYSTEM is the database superuser and is not intended for day-to-day activities in production systems. For better security, you can create other database users with only the privileges that they require for their tasks (for example, user administration), then deactivate the SYSTEM user.

  • Step 7

    In a terminal, log in as the hxeadm user:

    sudo su -l hxeadm

  • Step 8

    Create a new admin user with the USER ADMIN system privilege:

    SQL
    Copy
    /usr/sap/HXE/HDB90/exe/hdbsql -i 90 -d SystemDB -u SYSTEM -p "<SYSTEM-password>" "CREATE USER <admin-username> PASSWORD <admin-password> NO FORCE_FIRST_PASSWORD_CHANGE;"

/usr/sap/HXE/HDB90/exe/hdbsql -i 90 -d SystemDB -u SYSTEM -p "<SYSTEM-password>" "GRANT USER ADMIN TO <admin-username> WITH ADMIN OPTION;"
  • Step 9

    Use the new admin user to deactivate the SYSTEM user:

    SQL
    Copy
    /usr/sap/HXE/HDB90/exe/hdbsql -i 90 -d SystemDB -u <admin-username> -p "<admin-password>" "ALTER USER SYSTEM DEACTIVATE USER NOW;"
Back to Top
Back to top