Hello and welcome to the SAP HANA Academy.
The topic of this video tutorial series is SAP HANA Administration and in this video
I will discuss client-side data encryption and the HDB Key Store.
This video has been recorded on release SAP HANA 2.0 SPS 03, released in April 2018.
For earlier or later releases, please check the Administration playlist on the SAP HANA Academy.
Hi, I am Denys van Kempen.
In a previous video in this series we already discussed the hdbkeystore command.
Here we see it on Windows.
Here we see it on Linux, same thing.
Run the command without options and usage information is displayed.
Here is a tricky question for you.
To decrypt an encrypted hdbkeystore, you need to provide a password (-p).
Now, let us assume we have just installed the SAP HANA client and we want to check the
contents of the key store.
Error: Password is required.
What’s the password?
Well, there isn’t any.
We have not used the key store yet.
How do we set it?
Don’t know.
It is not documented here in the usage.
And if we check the SAP HANA Administration Guide, hdbkeystore command reference.
We can see that it is basically the same as the usage information.
Well, as it happens, the key store password is set when we create our first key pair.
So, let’s create a key pair with name 'important' and password 'Initial1'.
So, now we have a password and we have a key pair in the key store.
The actual key store file, is, on Windows, in ProgramData\.hdb\ directory,
the SID of the current user and inside that directory the hdbkeystore.dat file (the actual store)
and also the SSFS key and store file.
ProgramData is a hidden directory.
It used to be the All Users directory on earlier versions of Windows and it is used for data
that is not user specific.
In previous videos, we have already seen that there is only a single key store for each SAP HANA client.
This key store may very well store multiple local key pairs but the key store password will be the same.
File access is read and execute for all users, so any Windows user with the keystore password
on this particular Windows client should be able to access the key store.
The fact that the SID of the current Windows user is in the path to the store does not restrict access.
On Linux, this works slightly different.
The hidden .hdb directory is created in the $HOME directory of the user that created the key store.
As a reminder, the keystore is created, for example, when we execute the
CREATE CLIENTSIDE ENCRYPTION KEY PAIR statement
with an ODBC client, like hdbsql, using the -Z CLIENTSIDE_ENCRYPTION_KEYSTORE_PASSWORD flag.
So, whoever executed that statement will also be the owner of the key store and when we
look at the file permissions, it is read-write (rw) only for the user.
Nobody else will have access.
Here, I am using the root user to interact with the SAP HANA client, that will be a very uncommon scenario,
but it is something to keep in mind.
OK— back to Windows
We created a key pair and now we have a key store.
Say, we want to change the key store password.
How do we do that?
Well, currently, there is no command to do that. So, what we need to do is export the contents
of the key store, delete the store on the file system, and then import the contents back again.
Here we have the export command.
-p for the password, * (export all key pairs), name of the export file,
and optionally a password to encrypt the private key in the export file. You never know.
We can open the file with notepad, and, it certainly looks like the private keys are encrypted.
OK —We could remove the key from the key store just in case we want to make absolutely sure
the keystore file is not put back from the recycle bin.
I will skip that and go to explorer and delete the keystore file.
Now the key store is gone.
Could not open key store.
OK —Let’s import the file back again.
This time, let’s use a more random string as password.
OK — Successfully imported key IMPORTANT
And if we list the key, we can see that we got our key store back again and we have updated the password.
OK—so much for this hdbkeystore “Under the Hood”
Thanks for watching.
You can find more video tutorials on our YouTube channel and if you would like to be informed
about new video tutorials, please subscribe to our channel.
You can connect with us on LinkedIn or follow us on Twitter, as well for updates and
if you are watching this video on YouTube, do not hesitate to leave your comments to the
video page and, if you like, give us your vote on this video.
Thank you for watching.