Risk
Weak passwords, old hashes and long-lived initial passwords increase account takeover risk.
ABAPJavaHANA
Settings and priorities
| Technology / priority | Parameter or mechanism | Setting and purpose |
|---|---|---|
| ABAP Critical | login/min_password_lng | ≥ 12 Policy equivalent: MIN_PASSWORD_LENGTH. |
| ABAP Critical | login/password_max_idle_initial | 1–14 days; recommended 7 Policy equivalent: MAX_PASSWORD_IDLE_INITIAL. |
| ABAP Critical | login/password_downwards_compatibility | 0 Avoids old, weak hashes for backward compatibility. |
| ABAP Standard | login/password_compliance_to_current_policy | 1 Enforces compliance at logon; does not affect System and Service users. |
| ABAP Standard | USR02 · BCODE and PASSCODE | No redundant legacy hashes Remove through the appropriate SAP procedure, not direct table editing. |
| ABAP Standard | icf/reject_expired_passwd ; rfc/reject_expired_passwd | 1 ; 1 Rejects expired or initial passwords in these channels. |
| ABAP Extended | login/password_expiration_time | 1–183 days Decide within the organization’s password policy. |
| ABAP Extended | login/fails_to_user_lock ; login/failed_user_auto_unlock | 1–5 ; 0 Controls locking after failed attempts. |
| ABAP Extended | login/password_history_size | ≥ 5 Restricts password reuse. |
| Java Critical | ume.logon.security_policy.password_min_length | ≥ 12 Minimum UME password length. |
| Java Extended | ume.logon.security_policy.password_expire_days | ≤ 183 Password change interval under the adopted policy. |
| Java Extended | ume.logon.security_policy.password_history | ≥ 5 UME password history. |
| HANA Critical | minimal_password_length ; maximum_unused_initial_password_lifetime | ≥ 12 ; ≤ 14 days The password policy section in indexserver.ini. |
| HANA Standard | force_first_password_change | true Requires a password change at first logon. |
| HANA Extended | maximum_password_lifetime | ≤ 183 days A justified exception may apply to technical users. |
| HANA Extended | maximum_invalid_connect_attempts ; password_lock_time | ≤ 6 ; ≥ 1440 minutes Limits failed attempts and defines the lock duration. |
| HANA Extended | last_used_passwords ; minimum_password_lifetime | ≥ 5 ; ≥ 1 day Defines password history and minimum lifetime. |
Extended settings provide a higher protection level to adopt through organizational policy. Account for SSO, technical account procedures, emergency password changes and integration impact.
How to verify
- Check global parameters and policies assigned to individual users.
- Separate interactive and technical accounts.
- Review old hashes, initial passwords and account locks.
- Test how password rejection affects RFC and ICF integrations.