Risk
Test services and unrestricted network interfaces increase the attack surface.
ABAPHANABTP
Settings and priorities
| Technology / priority | Parameter or mechanism | Setting and purpose |
|---|---|---|
| ABAP Standard | auth/rfc_authority_check | 1, 6 or 9, depending on the scenario Enables RFC authorization checks with different scopes. |
| ABAP Standard | rfc/callback_security_method | 3 Target enforcement of callback allowlists. |
| ABAP Standard | rfc/selftrust | 0 Disables implicit trust between clients. |
| ABAP Standard | login/disable_cpic | 1 Disables inbound CPIC communication. |
| ABAP Standard | ixml/dtd_restriction | expansion or prohibited Restricts DTD processing in XML. |
| ABAP Standard | SICF | Disable unnecessary and test services Account for business use and approved exceptions. |
| ABAP Standard | UCON HTTP allowlist | Zones 01 and 03, with protection 02 active Trusted Network Zone, CSS Style Sheet and Clickjacking Framing Protection. |
| HANA Critical | global.ini · communication · listeninterface | .local for single host; .internal for distributed For distributed systems, maintain internal_hostname_resolution and a separate network. |
| BTP Standard | Cloud Connector | High availability Maintains connectivity to the subaccount. |
Services to review include /sap/bc/echo, /sap/bc/error, /sap/bc/FormToRfc, /sap/bc/report, /sap/bc/soap/rfc, /sap/bc/webrfc, /sap/bc/xrfc and BSP demonstration services. Assess the impact before disabling integrations in use.
How to verify
- Review active SICF services and their owners.
- Test callback allowlists before enforcing the target configuration.
- Confirm restrictions on internal HANA communication.
- Review UCON HTTP and Cloud Connector configuration.
Related topics
RFC · UCON: reducing remote exposure ↗