Thursday, 22 September 2016

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

Pre-requisites:

HANA Server is installed and running
HANA studio is installed in the local system
Access to the HANA server
Putty / WinSCP tools

HANA Server and client without SSL configured:


Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

Steps need to be performed in HANA Server:

Login to HANA server system using Putty, as a root user and check if the libssl.so file exists. If not, create a symbolic link to libssl.so.0.9.8.

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

Now login to HANA server system, as a “<sid>adm” user.

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

Create the Root Certificate:

1. Go to Home directory “/usr/sap/<sid>/home”
2. Create directory with a same “.ssl”
3. Get into “.ssl” directory

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

4.  Execute the following command
openssl req -new -x509 -newkey rsa:2048 -days 3650 -sha1 -keyout CA_Key.pem -out CA_Cert.pem -extensions v3_ca

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

5. Enter the relevant details

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

6. This will create couple of files (CA_Cert.pem and CA_Key.pem) in “.ssl” directory

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

Create the Server Certificate:

1. Get into “.ssl” directory
2. Execute the following command and Enter the relevant details
openssl req -newkey rsa:2048 -days 365 -sha1 -keyout Server_Key.pem -out Server_Req.pem -nodes

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL


 3. This will create a couple of additional files (Server_Key.pem and Server_Req.pem) in “.ssl” directory
 4.  At this time, you will have 4 .pem files under “.ssl” directory

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

Sign the Server Certificate:

1. Get into “.ssl” directory
2. Execute the following command and Enter the relevant details
openssl x509 -req -days 365 -in Server_Req.pem -sha1 -extfile /etc/ssl/openssl.cnf -extensions usr_cert -CA CA_Cert.pem -CAkey CA_Key.pem -CAcreateserial -out Server_Cert.pem

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

3.  At this time, you will additionally have one new .pem file(Server_Cert.pem) and one new .srl file(CA_Cert.srl) created under “.ssl” directory as shown above

Chain the Certificate:

1. Get into “.ssl” directory
2. Execute the following command
cat Server_Cert.pem Server_Key.pem CA_Cert.pem > key.pem
3. At this time, you will additionally have one new .pem file(key.pem) created under “.ssl” directory. Totally there will be 7 files under this directory

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

Copy the Certificate:

1. Get into “.ssl” directory
2. Execute the following command
cp CA_Cert.pem trust.pem
3. This will create one new trust.pem file, as you just did a copy

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

Restart HANA Server:

1. Go to /usr/sap/<sid>/HDB<InstNo>
2. Stop the HANA Server using ./HDB stop and then start the HANA server using ./HDB start

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

Steps need to be performed in HANA Studio:

Copy “trust.pem” to local client:

Using WinSCP Tool copy the trust.pem from “.ssl” directory to c:\temp\

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

Import “trust.pem”:

1. As user ‘Administrator’, or with administrative access, import trust.pem into Java’s keystore. This can be done as below
2. Copy the Java bin directory location from HANA Studio

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

3. Run the Command prompt (with Run As Administrator), and go to Java bin directory location copied above

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

4. Execute the command keytool.exe -importcert -keystore "C:\Program Files\SAP\hdbstudio_Rev93\plugins\com.sap.ide.sapjvm.jre.win32.x86_64_81.0.0\jre\lib\security\cacerts" -alias HANServer -file c:\temp\trust.pem

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

5. Enter the keystore password and the default password for the Java keystore is “changeit”. Once the password is entered, and the certificate details will be shown. Enter “yes” to trust the certificate

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

6. Now the Certificate would be added to the keystore

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

Enable SSL Communication:

1. Close HANA Studio(if it’s opened already)
2. Open the HANA Studio and go to Administrator’s perspective, right click and add the HANA system (MK2 in our case)
3. Enable “Connect using SSL”, in the Connection Properties dialog and click Finish

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

4. Now hover the added HANA(MK2) system, you will observe a small lock on the system along with SSL indication in the tooltip as shown below

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

Now the SSL has been configured between HANA Server and HANA Studio and the communication is secured.

Source: scn.sap.com

No comments:

Post a Comment