Configure SAP HANA 2.0, express edition Security
- How to perform security tasks to ensure that your security settings are not known outside your organization
Prerequisites
- Step 1
Installing SAP HANA 2.0, express edition installs a permanent 32 GB license automatically. No license configuration is required.
- Step 2
Every user who downloads SAP HANA, express edition receives the same default encryption settings. Use the
change_key.sh
utility to change encryption automatically.Important: SAP recommends you run
change_key.sh
immediately after installation to ensure your security settings are not known outside your organization.The
change_key.sh
utility:-
Changes the secure stores in the file system (SSFS) master keys. The script re-encrypts the master key of the instance SSFS and re-encrypts the system PKI SSFS with a new key.
-
Changes the encryption root keys. The script generates new keys, backs them up, and activates them.
-
- Step 3
Follow this procedure to run the script:
At the command prompt, type:
/usr/sap/HXE/home/bin/change_key.sh
- Step 4
The script prompts you for:
Prompt Description HANA Instance Number Enter the default (90). System user password You specified this password when you were prompted for HANA database master password. Root key backup password Enter a strong password. The root key backup password is required to securely back up the root keys and subsequently restore the backed-up root keys during data recovery. For information on root key backup, see Root Key Backup. Root key directory A directory to store the root key backup password securely. Choose a non-temporary directory. For example /usr/sap/HXE/HDB90
. - Step 5
Enter Y when prompted. The script runs. Wait for the
hxehost:hxeadm>
prompt to return (approximately 30 seconds).New data will now be encrypted with the new keys.
- Step 6
SYSTEM is the database
superuser
and is not intended for day-to-day activities in production systems. For better security, you can create other database users with only the privileges that they require for their tasks (for example, user administration), then deactivate the SYSTEM user. - Step 7
In a terminal, log in as the
hxeadm
user:sudo su -l hxeadm
- Step 8
Create a new admin user with the USER ADMIN system privilege:
SQLCopy/usr/sap/HXE/HDB90/exe/hdbsql -i 90 -d SystemDB -u SYSTEM -p "<SYSTEM-password>" "CREATE USER <admin-username> PASSWORD <admin-password> NO FORCE_FIRST_PASSWORD_CHANGE;" /usr/sap/HXE/HDB90/exe/hdbsql -i 90 -d SystemDB -u SYSTEM -p "<SYSTEM-password>" "GRANT USER ADMIN TO <admin-username> WITH ADMIN OPTION;"
- Step 9
Use the new admin user to deactivate the SYSTEM user:
SQLCopy/usr/sap/HXE/HDB90/exe/hdbsql -i 90 -d SystemDB -u <admin-username> -p "<admin-password>" "ALTER USER SYSTEM DEACTIVATE USER NOW;"