Hello and welcome to the SAP HANA Academy.
The topic of this video tutorial series is SAP HANA Administration and in this video
I will discuss installation and configuration topics for client-side data encryption.
This video has been recorded on release SAP HANA 2.0 SPS 03, released in April 2018.
For earlier or later releases, please check the Administration playlist on the SAP HANA Academy.
Hi, I am Denys van Kempen.
On the subject of installing client-side data encryption, we can be short: it comes with
the SAP HANA client and all we need to do to configure client-side encryption is to
set two environment variables.
That’s it.
Now, instead of adding a 5 second video tutorial to this playlist, just showing how to set
environment variables, we will zoom in a bit on the topic, as to provide some background.
This might help you with troubleshooting installations, for example.
OK— The library used for encryption is the SAP Common Crypto Library.
The SAP HANA Client Installation and Update Guide shows where this component can be downloaded
from SAP Downloads —here we can see that— and because there are regular updates, you
might want to keep an eye on this.
Now, when we download the SAR file and extract it using the SAPCAR utility
—I am assuming you are already familiar with this, if not, there are many video tutorials
about installing the SAP HANA client on the different platforms—if we then look what’s
in the box, it’s the SAPCRYPTO.DLL file that provides the main functionality together
with the SAPGENPSE executable. —on Linux, both files are present as well with the DLL
being a file with the SO (shared object) extension, same thing—when we look at the executables
and dynamic link libraries of the installed SAP HANA client on this Windows server, we
find the same SAPCRYPTO.DLL and the SAPGENPSEand if we then look at the installation media
for the SAP HANA client, let’s take the 64-bit Windows version
client folder: COMMONCRYPTOLIB.TGZ,
that may come as a surprise, TGZ, a GNU zipped TAR file, this is typical for Linux but very
untypical for Windows, I will use 7-Zip to open the archive, and then the TAR fileand
here we have our SAPCRYPTO.DLL and SAPGENPSE executable again, EXE and DLL, this time,
as they are intended for Windows.
So, as a rule, both should be included with the client installation package and automatically
get installed when you install the SAP HANA client.
Should you need to update the cryptography library, you can download the latest version
from SAP Downloads on the SAP Support Portal.
Now, both SAPCRYPTO and SAPGENPSE are not specific to client-side data encryption for SAP HANA.
Most of you will be familiar with this, as they have been used for over a decade, for
example, to secure network communications between client and server for SAP Applications,
AS ABAP, and so on.
We see this often in SAP HANA, where mature technology is leveraged to implement new features
and functionality.
For SAPGENPSE to be able to do its work, we nee d to set two environment variables:
PATH and SECUDIR.
Let’s first take a look on how this works on Windows.
If we run an SQL command with the CLIENTSIDE ENCRYPTION clause, for example, the command
to create a new encryption key pair, using the SAP HANA interactive terminal, hdbsql,
and specifying the password to the key store with a ‘-Z’ the error is returned
10429 sapcrypto library was not initialized.
Check that the sapcrypto library is in the library path and SECUDIR is set appropriately.
What does this mean?
Well, we need to update the PATH environment variable to include the path to the SAP HANA client
On my computer, this is Program Files\sap\hdbclient.
This is the default for 64-bit Windows.
If, on your computer, the HANA client is installed elsewhere, make sure to use that path.
with the original PATH appended.
Don’t forget.
We also need to set SECUDIR to the same location and if we now run our command. All is well.
However, we have just set the environment variables to the current session.
Should we close the Command Prompt, the settings will be gone as well.
To do this properly, we need to set them as system environment variables.
Open Explorer, right-click This Computer, or this PC: Properties This is a shortcut
for Control Panel > System and Security > System and then Advanced system settings, Environment Variables.
Then we have user and system variables.
Under system variables, look for the PATH.
Edit
New
Paste in the path to the SAP HANA client (no need for quotes, this time)
You can move it up, but there is only one entry, so not required —OK.
Then, New
Variable Name: SECUDIR
Variable Value: again the path to the SAP HANA client.
OK
Here we have it.
Looking good.
OK.
Now, if we close all windows
Including the Command Prompt and open a new Command Prompt and run our command,
we no longer get any error.
Client-side encryption has been configured correctly.
How does this work on Linux?
Same thing
Instead of the PATH, we need to set the LD_LIBRARY_PATH
LD (link directory) the directory to the shared object files,
the equivalent of DLL on Windows.
Now, for the Bash shell, we use ‘export’ and then
:$LD_LIBRARY_PATH to append the original path.
For the C shell, used by S/4HANA for example, this will be different.
You would use set environment (setenv)
and I will add an example to the description below of this video on YouTube.
Then, we also need to set the SECUDIR.
No spaces, so no quotes.
Then, but this is not required at all, I will also set an environment variable for the password.
If you start the command with a space, it will not be recorded in the history file.
Just make sure nobody is looking at your screen now.
And then we can update the value for the
-Z CLIENTSIDE_ENCRYPTION_KEYSTORE_PASSWORD parameter
and point to the environment variable.
Now, let’s run our command.
OK, keypair already exists.
My mistake.
Let’s drop it, then.
Here we can already see that everything has been setup correctly, no errors about libraries
not initialized
And then, why not, just create the keypair again, and all is well.
Now, if I tail out the history file for you, we can see that command history has captured
all commands but not the command to set the password as environment variable.
So, should anyone get access to the history file somehow, it will not contain any password,
as it should be.
OK.
One more thing.
The crypto.policy of the Java runtime needs to be set to unlimited.
This is already the case on the latest versions of the JDK, version 10.
So, there is nothing to do.
But on older versions, you probably need to configure this.
Here we have the java.security file.
For JRE 8, it is in lib > security.
Lots of text and settings.
Just search for 'crypto.policy' or 'unlimited'
And here we have it.
It is in the section, Cryptographic Jurisdiction Policy defaults. You can read here what it does and don’t forget
to consult your export/import control counsel or attorney to determine the exact requirements.
OK — this is where the file is, for Java runtime 1.8 Program Files > Java > JRE > lib > security
For the development kit, JDK, it is in conf > security
On, Linux, exactly the same thing.
You only need to figure out what version of Java has been installed and where it is installed,
so you can check the java.security file for the crypto.policy parameter.
Again, for Java 10 it is set to unlimited, and there is nothing to do.
For the older versions, see the SAP HANA Client Installation and Update Guide.
You might have to download some files from java.com and perform some manual configuration.
This is different again for each operating system and java version, so I will not go into this here.
If you can, just update to Java 10.
Probably more secure, anyway.
OK— Client-side encryption installation and configuration is documented in the
SAP HANA Client Installation and Update Guide —but as we have seen, typically, all that
needs to be done is to set two environment variables.
For the concepts, see the SAP HANA Security Guide, for the activities, the SAP HANA Administration Guide,
and for the command syntax, the SQL Reference.
Thanks for watching.
You can find more video tutorials on our YouTube channel and if you would like to be informed
about new video tutorials, please subscribe to our channel.
You can connect with us on LinkedIn or follow us on Twitter, as well for updates and if
you are watching this video on YouTube, do not hesitate to leave your comments to the
video page and, if you like, give us your vote on this video.
Thank you for watching.