Risk
Unauthorized Message Server access can compromise communication and trust between instances.
ABAPJava
Settings and priorities
| Technology / priority | Parameter or mechanism | Setting and purpose |
|---|---|---|
| ABAP Standard | rdisp/msserv_internal | Separate internal port Block access from client networks through firewalls. |
| ABAP Standard | ms/monitor ; ms/admin_port | 0 ; 0 or no admin port Disables external monitoring and administration. |
| ABAP Conditional | ms/acl_info | Maintained ACL without HOST=* Priority depends on system/secure_communication activation. |
| ABAP Critical | ms/server_port_<xx> | No unauthenticated exposure; include ACLFILE if used Also control dynamic changes. |
| Java Standard | Message Server ports and monitoring | Apply the same separation and protection principles Protect Message Server in Java systems as well. |
| Java Critical | ms/server_port_<xx> | No unauthenticated monitoring Review ACLFILE for exposed ports. |
The ms/acl_info requirement and the prohibition of HOST=* are Critical or Extended depending on internal communication protection. In ABAP, system/secure_communication=ON reduces the criticality of these two controls.
How to verify
- Confirm that only trusted instances can reach the internal port.
- Review ACLs and remove unrestricted allow entries.
- Check effective parameters, including dynamic changes.
- Review RZ11 changes and Q19/Q1A messages in SM21.