Linux-UNIX: Using SAP HANA with encrypted connections

When SAP HANA is configured with SSL/TLS encryption, S-TAP® must use a proxy configuration to inspect traffic.

About this task

Since S-TAP cannot directly inspect encrypted client traffic when SAP HANA is configured with SSL/TLS encryption, you must set up two proxies with either NGINX or HAProxy.

Option 1:Configure two proxies with NGINX

Edit online

Before you begin

Verify the following prerequisites:

S-TAP is installed and configured on the SAP HANA server.
NGINX is installed and configured for reverse-proxy connections.
SAP HANA is configured to use only SSL/TLS connections and the database global configuration enforces SSL/TLS. For example:
```
[communication]
ssl = on
sslEnforce = true
```

Procedure

Identify the ports clients use to connect to the database.

Configure NGINX by using the configuration file that is typically located at /etc/nginx/nginx.conf.

For example, assuming that the original port for client connections to the database is 30015 and the SSL certificate is sap-hana.pem:

worker_processes  1;

load_module lib64/nginx/modules/ngx_stream_module.so;

events {
    worker_connections  1024;
    use epoll;
}
stream {
        upstream saphana {
                server localhost:30015;
        }

        server {
                listen 31015 ssl;
                proxy_pass localhost:32015;
                proxy_protocol on;
                ssl_certificate /hana/shared/HXE/HDB00/su12u2ppc64le-hana/sec/sap-hana.pem;
                ssl_certificate_key /hana/shared/HXE/HDB00/su12u2ppc64le-hana/sec/sap-hana.key;
        }
        server {
                listen 32015 proxy_protocol;
                proxy_pass saphana;
                proxy_ssl on;
                proxy_ssl_certificate /hana/shared/HXE/HDB00/su12u2ppc64le-hana/sec/sap-hana.pem;
                proxy_ssl_certificate_key /hana/shared/HXE/HDB00/su12u2ppc64le-hana/sec/sap-hana.key;
        }
}

Restart the NGINX service by using the following command: systemctl restart nginx.

Configure the S-TAP for SAP HANA by using the second proxy port.

For example, in a typical inspection engine configuration:

[DB_0]
connect_to_ip=127.0.0.1,::1
db2_fix_pack_adjustment=20
db2_shmem_client_position=61440
db2_shmem_size=131072
db2bp_path=NULL
db_exec_file=NULL
db_install_dir=NULL
db_user=NULL
db_type=HANA
encryption=0
informix_inf_file=NULL
db_version=
instance_running=1
intercept_types=NULL
load_balanced=1
port_range_end=32050
port_range_start=32010
priority_count=20
real_db_port=32015
tap_identifier=SAP-HANA
tee_listen_port=0
unix_domain_socket_marker=NULL
networks=0.0.0.0/0.0.0.0,::/0
exclude_networks=

Note: If clients use multiple ports for database connections, the NGINX configuration file requires multiple reverse-proxy sections.

Option 2: Configure two proxies with HAProxy

Edit online

Configure two HAProxy proxies so that the first proxy decrypts the client traffic and forwards it to a local port that S-TAP can inspect. The second proxy encrypts the traffic again and forwards it to SAP HANA.

Before you begin

Verify the following prerequisites:

S-TAP is installed and configured on the SAP HANA server.
HAProxy is installed on the SAP HANA database server or on a separate proxy host.
Note: The HAProxy host must be able to connect to the SAP HANA encrypted SQL port. For example, with instance number 00, the encrypted SQL port is commonly 30013.

Procedure

Configure HAProxy by using the configuration file that is typically located at /etc/haproxy/haproxy.cfg.

For example, assuming that the original port for client connections to the database is 30015, the local port for decrypted traffic is 32015, the real SAP HANA encrypted SQL port is 30013, and the SSL certificate is sap-hana.pem:

global
    log /dev/log local0
    log /dev/log local1 notice
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin
    stats timeout 30s
    user haproxy
    group haproxy
    daemon
    maxconn 4000
    tune.ssl.default-dh-param 2048

defaults
    log     global
    mode    tcp
    option  tcplog
    option  dontlognull
    timeout connect 10s
    timeout client  1m
    timeout server  1m

frontend hana_ssl_frontend
    bind *:30015 ssl crt /etc/haproxy/sap-hana.pem
    mode tcp
    default_backend hana_internal_backend

backend hana_internal_backend
    mode tcp
    server hana_stage2 127.0.0.1:32015 send-proxy-v2

frontend hana_internal_frontend
    bind 127.0.0.1:32015 accept-proxy
    mode tcp
    default_backend hana_ssl_backend

backend hana_ssl_backend
    mode tcp
    server hana_db <hana_server_ip>:30013 ssl verify required ca-file /etc/haproxy/sap-hana-ca.pem

The ca-file value must point to the certificate authority file that validates the SAP HANA server certificate.

Validate the HAProxy configuration.
```
haproxy -c -f /etc/haproxy/haproxy.cfg
```

Restart HAProxy.

systemctl restart haproxy
systemctl status haproxy

Configure SAP HANA clients to connect to the client-facing HAProxy listener.
In this example, SAP HANA clients connect to port 30015 on the HAProxy host. HAProxy forwards traffic to the SAP HANA encrypted SQL port 30013.

Configure the S-TAP inspection engine.

[DB_0]
aso_enabled=0
connect_to_ip=127.0.0.1,::1
db2_fix_pack_adjustment=20
db2_shmem_client_position=0
db2_shmem_size=131072
db2bp_path=NULL
db_exec_file=NULL
db_install_dir=NULL
db_type=HANA
db_user=NULL
encryption=0
db_version=0
instance_running=1
intercept_types=NULL
load_balanced=1
port_range_end=32015
port_range_start=32015
priority_count=20
real_db_port=32015
tap_identifier=HANA_saphana
tee_listen_port=0
unix_domain_socket_marker=NULL
networks=0.0.0.0/0.0.0.0,::/0
exclude_networks=

If HAProxy runs on a separate proxy host, install and configure S-TAP on the HAProxy host, and set networks to match the interface or subnet that receives the decrypted local traffic.

Note: Increase maxconn and timeout values as needed for environments with high connection counts or long-running SAP HANA queries.