External SAP HANA PSE File and Certificate Management

External SAP HANA PSE File and Certificate Management

Certificates can also be stored and managed within files located in the file system of the SAP HANA instance. 

By default, they’re stored in the following path:

/hana/shared/<SID>/HDB<instance number>/<host name>/sec

you’ll find several files with a .pse extension. For example:

sapsrv.pse

saplogon.pse

sapslcs.pse

sapsys.pse

sap_system_pki_instance.pse

sap_system_pki_internal.pse

sapsrv_internal.*.pse

Each file has an intended purpose,

1.authentication 

2.TLS secure communication.

There are two main ways to configure PSE files:

1. Command-line using SAPGENPSE tool

2. Web-based SAP Web Dispatcher Administration GUI

*using SAP web dispatcher tool, we can manage .pse certificates effectively.

To access the Web Dispatcher Admin GUI, the user must have the role:

sap.hana.xs.wdisp.admin::WebDispatcherAdmin

Access URL example:

http://<SAP_HANA_XS_HOST>:80(<instance #>)/sap/hana/xs/wdisp/admin/

Example:

http://w4-dh-hana19e-corp.root.internal.com:8000/sap/hana/xs/wdisp/admin

Authentication is required with SAP HANA internal user credentials.

the landing page will default to the SAP web dispatcher monitor.on the leftside,MENU -->PSE management-->just under the SSL and trust configuration.

The interface has a Manage PSE dropdown where you select the PSE file to manage.

With a PSE selected, the following actions are available:

Interface Option | Description

Recreate PSE

When selected, the active PSE file will be reset to a default state. All certificates will also be removed from the trust store.

Delete PSE

To delete a PSE from the file system, select the PSE file in the Manage PSE dropdown menu, then select this option.

Create New PSE

Used to create a new PSE. When clicked, a new window will appear, allowing you to define the PSE encryption algorithm, key length, distinguished name, and file name.

Export Own Certificate

When selected, a new window will appear containing the certificate of the selected PSE file.

Create CA Request

When selected, a new window will appear containing the certificate request text. Copy this text to a certificate authority to generate a new certificate response.

Import CA Response

When selected, a new window will appear containing a text entry block in which the certificate response text can be pasted or entered.

Import Certificate

When selected, a new window will appear containing a text entry block in which a trusted certificate’s text can be pasted or entered.

Software Authenticity Verification

 An SAP HANA system can be installed using the SAP HANA database lifecycle manager (HDBLCM). Since the installation software is downloaded from outside your network, it cannot be trusted. Therefore, you should first make sure that the components are authentic, before starting the SAP HANA database lifecycle manager (HDBLCM). 

To verify the authenticity of a SAR archive, use the following command:

 /usr/sap/hostctrl/exe/SAPCAR -dVf /usr/sap/hostctrl/exe/ libsapcrypto.so 

To verify the signature the additional components, run hdblcm with the parameter verify_signature. For more information, see SAP Note 2577617. 

•  the authenticity verification is only enabled by default if the SAP HANA database was installed or updated with an authentic signature. The signature file is located under <inst_path>/<SID>/hdblcm/SIGNATURE.SMF).
•  If you are not sure whether the SAP HANA system was installed with a valid signature, you can run the SAP HANA resident HDBLCM with the parameter verify_signature. 

Check file system space script

Method - 1:

Disk Space Check
=================

# Check the filesystem

df -h

# Remove un-wanted rows

df -h | egrep -v "Filesystem|tmpfs"

# Get 5th and 6th column

df -h | egrep -v "Filesystem|tmpfs" | awk '{print $5, $6}'

df -h | egrep -v "Filesystem|tmpfs" | awk '{print $5}' | cut -d'%' -f1`

--------------------------------------------

First For loop script

vi checkdisk

#!/bin/bash

a=`df -h | egrep -v "tmpfs|devtmpfs" | tail -n+2 | awk '{print $5}' | cut -d'%' -f1`

for i in $a
do
        if [ $i -ge 50 ]
        then
        echo Check disk space $i `df -h | grep $i`
        fi
done

--------------------------------------------

Method - 2:

#!/bin/sh

df -H | grep -vE '^Filesystem|tmpfs|cdrom' | awk '{print $5,$1}' | while read output
do
        usep=$(echo $output | awk '{print $1}' | cut -d'%' -f1  )
        partition=$(echo $output | awk '{print $2}' )
       
        if [ $usep -ge 90 ]
        then
        echo "Running out of space \"$partition ($usep%)\" on $(hostname) as on $(date)"
        fi
done

--------------------------------------------

Method - 3 (simple method):

#Write a script to awk only those rows with the value

#!/bin/sh

df -h | awk '0+$5 >= 10 {print}'

To make it presentable

echo
echo Following is the disk space status
echo
df -h | awk '0+$5 >= 10 {print}' | awk '{print $5, $6}'

Backup of file system using scripts and moving the backup file to remote server.

 #!/bin/bash
# This script is used to take backup of mount point /var and /etc

tar -cvzf /tmp/backup.tar.gz /var /tmp
find /tmp/backup.tar.gz -mtime +1 -type f -print &> /dev/null
If [ $? -eq 0 ]
        then
        echo backup completed successfully
        echo
 echo moving backup file to backup  server...
   echo .
   echo ..
   echo ...
scp /tmp/backup.tar.gz  root@192.168.1.1 x:/backup/
else
echo backup failed
echo
echo troubleshoot the script
fi

:wq!

Access data from file in linux scripts

instead of search for one particular word line by line in file using the below command in scripts

In manual way of running Linux command, more command is useful to search for key word.

The follow method can be used to search for a key word in file in script point of view.

1. To grep error messages from log file.

                  grep -i error /usr/sap/sid/work/dev_disp.log

      2.To grep warming messages from log file.

                 grep -i warning /usr/sap/sid/work/dev_disp.log

      3. To grep  for fail  key word in the file.

                grep -i fail /usr/sap/sid/work/dev_disp.log

Output to file:To send output  of above cmd to one file use syntax as below:

grep  -i error /usr/sap/sid/work/dev_disp.log > /install/error.log

vi - to edit the file

$ vi <file_name>

ex

$ vi Naveen.txt

Here

Naveen.txt is file name


The Vi command used for editing the file.

cat - concatenates and display files.

$ cat 

The cat command, concatenates and display files. this is the command you run to view the contents of a file.

ex:

% cat <hello.txt>

this is the first line
this is the second line


here hello.txt is the file name to be displayed.

cp - to copy the file in linux, to take backup of file in linux

$ cp <file_name>  <file_name.bkp>

ex:
$ cp  Naveen  Naveen_bkp

to copy the file in linux or to take the backup of existing file in linux

How to change file owners in LINUX and UNIX using PUTTY tool

chown SIDADM:sapsys <path of file>/filename

here 

SIDADM & sapsys  are users in the Linux machine, by running the above command file owner will change from sidadm to sapsys.