Risk
Bypassed application checks or excessive system account privileges weaken the entire system.
ABAPOS
Settings and priorities
| Technology / priority | Parameter or mechanism | Setting and purpose |
|---|---|---|
| ABAP Standard | dynp/checkskip1screen or dynp/confirmskip1screen | ALL for one parameter, not both Controls skipping the initial screen. |
| ABAP Standard | auth/check/calltransaction | 2 or the recommended 3 Controls authorization checks for CALL TRANSACTION. |
| ABAP Standard | auth/no_check_in_some_cases ; auth/object_disabling_active | Y ; N Defines authorization check behavior. |
| ABAP Standard | rdisp/gui_auto_logout | ≤ 3600 seconds Sets the GUI session idle timeout. |
| ABAP Standard | SACF_COMPARE | Activate applicable SACF scenarios Provide the required user authorizations first. |
| ABAP Standard | rfc/authCheckInPlayback | 1 Checks authorizations during RFC playback. |
| ABAP Extended | SLDW_COMPARE | Activate Generic Application Access Rules scenarios Maintains additional access rules. |
| OS Critical | SAPService<SID> and sapadm on Windows | No membership in local Administrators Separates service accounts from administrators. |
| OS Critical | <sid>adm and sapadm on Unix/Linux | No root privileges Keep /bin/false as the shell for sapadm. |
| OS Standard | saploc, sapmnt, /usr/sap, NFS | Dedicated accounts and systems only No access for everyone or all domain users. |
Secure by Default exceptions for SACF include BC_GENERIC_REPORT_START, BC_GENERIC_REPORT_START_BATCH, SACF_DEMO_SCENARIO and FIN_PARL_ACCTG_LEDGER. Activation decisions should reflect the scenario in use.
How to verify
- Check service accounts and access to SAP directories.
- Verify authorization parameters and the GUI idle timeout.
- Review active SACF and SLDW scenarios.
- Test dependent processes before changing settings.