Best Practices for Deploying HP-UX Secure Resource Partitions (SRP) for SAP Whitepaper

ManualsBrandsHP ManualsSoftwareHP-UX Containers (SRP)

Best practices for deploying HP-UX Secure

Resource Partitions (SRP) for SAP

Technical white paper

Table of contents

Executive summary ............................................................................................................................... 2

Deploying SRP ..................................................................................................................................... 3

SRP basic overview .......................................................................................................................... 3

SRP short comparison ....................................................................................................................... 4

Other considerations ........................................................................................................................ 5

Known limitations ............................................................................................................................. 8

Deployment best practices .................................................................................................................. 11

Best practices for configuring SRP for SAP during an installation .......................................................... 11

Best practices for configuring SRP for the SAP production system ......................................................... 13

Best practices for configuring saposcol for several SAP systems ........................................................... 15

Best practices for configuring SRP for upgrading an SAP system .......................................................... 17

Best practices for configuring SRP for de-installing an SAP system ........................................................ 18

Example configurations ...................................................................................................................... 19

How to enable login to the INIT compartment .................................................................................... 19

SRP rule file SAP_RUN.h for a running system .................................................................................... 19

SRP rule file SAP_INST.h ................................................................................................................. 20

SRP rule file DEFAULT_SAPOSCOL.h for non-saphostctrl use ................................................................ 21

SRP rule file DEFAULT_SAPHOST.h for saphostctrl use ........................................................................ 21

Script add_new_system ................................................................................................................... 21

Summary .......................................................................................................................................... 23

Appendix – Useful commands ............................................................................................................. 24

For more information .......................................................................................................................... 25

Summary of content (25 pages)

PAGE 1
Best practices for deploying HP-UX Secure Resource Partitions (SRP) for SAP Technical white paper Table of contents Executive summary............................................................................................................................... 2 Deploying SRP..................................................................................................................................... 3 SRP basic overview ...............................................................................
PAGE 2
Executive summary Consolidation of several SAP systems on one host might lead to questions like “How are resources distributed?” or “How can the SAP instances be secured from each other?” In addition to offering HP Virtual Machines (HP VM) or HP-UX Virtual Partitions (vPar), HP also offers another answer to this question: HP-UX Secure Resource Partitions (SRP).
PAGE 3
Deploying SRP SRP basic overview HP-UX Secure Resource Partitions (SRP) version 2 enables you to create and manage SRP compartments that provide isolated execution environments for applications.
PAGE 4
SRP short comparison SRP and vPars These two technologies are complementary. vPar is used when more than one OS image is needed. SRP can be used on top of vPar. Examples where SRP fits better than vPars (if only one of the technologies will be used):  Use SRP for smaller systems or systems not supported by vPars  Use SRP when resource utilization is a priority.
PAGE 5
Table 1. Naming convention SAP ID (SID) SAP system identifier DBSID Database identifier SAP INSTANCE Number (NR) SAP system instance number, consisting of a two digit number from 00 to 98 SAP INSTANCE SAP system instance, e.g. DVEBMGS for ABAP or SCS for JAVA™ instances host_name/vhost Name of the host on which SAP will be installed. May be the same as the hostname that resolves to the SRP compartment.
PAGE 6
Hostname considerations With SRP, it is possible to use the physical hostname for all SRP compartments or define a hostname for each SRP compartment. It is mandatory for each compartment to have a unique IP Address. It is dependent upon the planned SAP landscape as to whether or not a virtual host is used. If each SRP compartment has its own hostname, the SAP system should be installed with the virtual hostname option offered for sapinst.
PAGE 7
Figure 1. Simplified SAP directory isolation in two compartments Figure 1 shows how the simplified SAP default directories of two SAP systems are assigned to two SRP compartments. No user assigned to SRP compartment SAPSRP1 can log in to SRP compartment SAPSRP2 or read or modify the content of its files or directories. With different IPs and optional virtual hostnames connected to the SRP compartment, the two systems can be accessed individually.
PAGE 8
Known limitations Saposcol SAP delivers its own data collector, saposcol, to provide OS information (e.g. for CCMS). The data collector may run only once on a system. It addresses a shared memory segment with a predefined shared memory key that cannot be changed. If saposcol is started by an SAP instance in one compartment, other SAP instances cannot connect to saposcol due to the SRP compartment rules. They also cannot start their own saposcol because the shared memory segment is already occupied.
PAGE 9
Figure 2. Display issue in ST06 If the status overview in ST06 is mandatory in the user environment, then consider enabling the execution rights for saposcol in the respective SRP compartment rule file. Note Please note that in this case, saposcol can be stopped for the whole system from just one SAP system. Even if the execution access is allowed, the status display is not correct. In figure 2, the line item Collector in the status overview shows “not running (process ID not found).
PAGE 10
To avoid the error message, enter “send signal ” in the SRP rule file of the respective SRP compartment for each compartment in order to communicate with saposcol, then activate the new rules with the command “setrules”. The configuration examples in this document describe the restricted approach without signaling to the saposcol compartment, accepting the display issue in ST06. Currently saposcol is not capable of displaying the data per compartment if PRM is used.
PAGE 11
Deployment best practices Operating system choice The following OS requirements are needed for using SRP with SAP:  HP-UX 11i version 3 (11.31)  Minimum OS patch requirements for SAP according to SAP note 837670  HP-UX 11i kernel requirements for SAP according to SAP Note: 172747 The following product versions were used for the reference architecture:  HP-UX Secure Resource Partitions and Configuration Manager: HP-UX-SRPA.02.00.001  HP-UX Secure Shell: SecureShell A.05.20.
PAGE 12
later for the SAP installation as the virtual hostname (vhost). If each SAP system will run logically on a different host, the use of virtual hostnames is recommended. 5. Configure on the host in the INIT compartment as root user with the command srp_setup. For details about how to use srp_setup, refer to the SRP Administrator’s Guide. At a minimum, the following services must be activated:  cmpt  admin  init  login  network  provision 6.
PAGE 13
12. Only for Oracle installation: If the directory /oracle/oraInventory already exists on the host created by another Oracle installation in another SRP compartment, the next Oracle installation will have issues that can be avoided by utilizing either of the next steps:  Rename the existing directory but be very careful not to delete the directory as it will be needed for future Oracle updates or upgrades. If an Oracle upgrade is planned for later on, rename the directory back to “oraInventory”.
PAGE 14
3. For Oracle installations only:  Rename the oracle-client directory to something unique on the system, e.g. /oracle/client_. The compartment rules have to be adapted for this action. Most important to note is that while you are modifying the instantclient, full permission must be given to Oracle or else the task will have to be executed as root user in the INIT compartment.
PAGE 15
4. Now SRP has to be configured on the host. This is done in the INIT compartment as root user with the command srp_setup. For details how to use srp_setup, refer to the SRP Administrator’s Guide . At a minimum, the following services have to be activated:  cmpt  admin  init  login  network  provision 5. After initially calling srp_setup, login problems with another user than root to the INIT compartment might occur.
PAGE 16
For systems not using saphostctrl, follow these guidelines: 1. If saposcol is running, login to the SRP compartment as root in which saposcol is running and stop the process by calling “saposcol –k” 2. Create a new SRP compartment with own IP and LAN interface. The default SRP settings can be used for this. Select an existing root user for the compartment login. 3. Customize the rule file DEFAULT_SAPOSCOL.h and include it in the SRP compartment. 4.
PAGE 17
5. In the rule file for the SRP compartment, change the “perm none” entry from /sapmnt//exe/saposcol to /usr/sap/hostctrl 6. Activate the change to the SRP compartment with the command “setrules” 7. Either start the SAPHOST agent by restarting the SAPOSCOL SRP compartment or by logging in to the SAPOSCOL SRP compartment and calling “/usr/sap/hostctrl/exe/hostexecstart”.
PAGE 18
Best practices for configuring SRP for de-installing an SAP system In the life cycle of an SAP system, the last step is the de-installation of the system. With respect to SRP, the de-installation can be accomplished in one of two ways. 1. De-install SRP compartment first. If it is not necessary to have a high isolation level during the de-installation of the SAP system, the easiest way is to delete the SRP compartment for the respective SAP system and start the SAP de-installation from the INIT compartment.
PAGE 19
Example configurations How to enable login to the INIT compartment After calling srp_setup, login problems might occur if the default root user is not used to login to the INIT compartment. Starting with SRP 2.
PAGE 20
perm nsearch perm all /usr/sap/ccms /usr/sap/ccms/_SAP_SID___SAP_SYSNUM_ //none access rules perm none /sapmnt/_SAP_SID_/exe/saposcol SRP rule file SAP_INST.
PAGE 21
SRP rule file DEFAULT_SAPOSCOL.h for non-saphostctrl use // Edit this file manually // Variables to be replaced: // _SAP_SID_ for one SAP system on this host // _SAP_COMPARTMENT_ for each SAP SRP compartment //for one SAP system on the host Perm all /sapmnt/_SAP_SID_ /exe/saposcol Perm all /usr/sap/tmp //for each SAP SRP compartment on the host grant ipc <_SAP_COMPARTMENT_ > … access ipc,fifo,uxsock * SRP rule file DEFAULT_SAPHOST.
PAGE 22
set BLOCK_FILE='/etc/cmpt/include/SAP_BLOCK.h' # Build custom include file for SAP to allow access to directories set sap_sid = `echo "$2" | tr "[A-Z]" "[a-z]"` set sidadm = `echo "$sap_sid"`adm if (-e "/etc/cmpt/$1_$5.h") then echo "File /etc/cmpt/$1_$5.h already exists. Existing rule file will be used.\nIf it will be replaced, delete it manually" else sed -e "s/_DB_SID_/$3/g" -e "s/_SAP_SID_/$2/g" -e "s/_sap_sid_/$sap_sid/g" -e "s/_SAP_SYSNUM_/$4/g" /etc/cmpt/include/SAP_$5.h >> /etc/cmpt/ $1_$5.
PAGE 23
Summary Using SRP for several SAP systems isolates the SAP systems from each other by using compartments. It is possible to define different levels of isolation, from user login and directory access to port blocking, by using IPFilter. Although the SRP compartments always use the same OS environment, virtual hostnames can be realized by using SRP and the resource management can be accomplished on a very granular basis per SRP compartment using PRM.
PAGE 24
Appendix – Useful commands 24  Report the current compartment getprocxsec –c  Report the compartment a process is running in getprocxsec –c  Add custom template to compartment srp –add -t custom  Replace custom template in compartment srp –r -t custom  Start SRP compartment srp –start  Stop SRP compartment srp –stop  List the IPFilter configuration /etc/opt/ipf/ipf.
PAGE 25
For more information HP-UX Secure Resource Partitions (SRP) Administrator's Guide HP-UX 11i v3 http://docs.hp.com/en/5992-4679/5992-4679.pdf Security Containment Administrator’s Guide and Release Notes http://docs.hp.com/en/internet.html#Security%20Containment Role-Based Access Control Administrator’s Guide and Release Notes http://docs.hp.com/en/internet.html#Role-Based%20Access%20Control Secure Shell login white paper http://docs.hp.com/en/5992-5374/5992-5374.pdf Secure Shell docs http://docs.hp.