Creating ACL File Entries Again

In transaction SMGW you can manage ACL files secinfo, reginfo, and prxyinfo. In the ACL monitor you can add new lines to ACL files.

1. To manage the ACL files, follow menu path:  Transaction SMGW  Goto  Expert Functions  External Security  Maintenance of ACL Files .
2. Select the ACL file by clicking on the tab in which you want to make changes.

   In the ACL monitor the contents of ACL files reginfo, secinfo, and prxyinfo are listed in a tab in the order they were read and interpreted by the RFC gateway at file level. If the secinfo- or reginfo file is not available, the default settings that were configured with profile parameter gw/acl_mode are displayed. The prxyinfo function is not activated until the prxyinfo file is created with profile parameter gw/prxy_info.

3. Select the line in the ACL file under which you want to add a new line.
4. Choose Add Line from the icon toolbar, and select the line type you want to create.
   You can choose from the following types:

   • Blank Line: You can use blank lines for overview purposes. They are simply ignored when the form is processed.
   • Comment: Comment lines are marked with a preceding # character and can be used for explanation or structuring purposes. They are simply ignored when the form is processed.
   • Default: Default lines must comply to ACL file syntax.
   • From the Buffer: Copied lines can be inserted.

   Blank lines, comment lines, and lines from the buffer are added directly to the ACL file without a dialog box opening. A dialog box opens for comment lines and default lines.

5. Fill in the corresponding fields.
   • You want to add a new comment line:

     In the Comment field, enter your text.

   • You want to add a new default line:

     Fill all mandatory fields and optional fields.

   • P/D: P stands for Permit and D stands for Deny. The letters must be in upper case.

     In the secinfo and reginfo files, P/D is a mandatory field if the first line of the ACL file contains the comment line #VERSION=2.

   • TP=:

     With secinfo file this corresponds to the name of the program on the operating system level.

     TP is restricted to 64 non-Unicode characters for both secinfo and reginfo files.

     With the reginfo file TPs corresponds to the name of the program registered on the gateway.

     TP is a mandatory field in the secinfo and reginfo files.

     Example

     Example 1:

     TP=XYZ*

     All external programs that start with XYZ are permitted.

     Example 2:

     TP=/usr/sap/PRD/SYS/exe/run/*

     Only programs from this directory are permitted.

   • USER: Name of the user who wants to run the program. If the program is started from the application server, this is the user name of the logon. If the program is started from an external program, this is the user name of the operating system. For Windows this is the value of the environment variable USERNAME. For Unix this is the value of the environment variable USER.

     User names must not contain placeholders unless the name is replaced completely with a truncation, for example USER=*.

     USER is a mandatory field in the secinfo file.

   • HOST:

     For the secinfo file this is the program that is to be started. Mandatory field in the secinfo file.

     For the reginfo file this is the host from which the registration attempts comes. HOST is not a mandatory field in the reginfo file. If you leave it empty, it is implicitly set to HOST=*.

     For HOST a list of host names, IP addresses, domain names, or subnet masks can be specified. Note that this list must not contain any blank lines in the secinfo file. Individual values must be separated by commas in the secinfo file. Placeholders are only permitted with restrictions.

     Example

     The following syntax is allowed for HOST:

     HOST=*

     No restrictions.

     HOST=10.18.100.*

     All hosts from this subnetwork are allowed.

     HOST=*.sap.corp

     All hosts from this network domain are allowed.

     HOST=sapprd,10.18.100.*

     Any size list with no blank lines, separated by commas.

     The following syntax is not allowed for HOST:

     HOST=sap*

     Placeholder in host name.

     HOST=10.18.1*.100

     Placeholder in a part of the subnet mask.

     HOST=sapprd, 10.18.100.*

     Not allowed in the secinfo file: Any size list separated by commas but with blank lines before or after the commas.

   • USER-HOST=:

     Only relevant in secinfo file. No mandatory field. If you leave it empty, it is implicitly set to USER-HOST=*. Defines the source host (USER-HOST) and target host (HOST) where an attempt to start a program is permitted.

     You can specify a list of f host names, IP addresses, domain names, or subnet masks for USER-HOST. This list must be separated by commas and no blank lines are allowed. Placeholders are only permitted with restrictions.

     Example

     The following syntax is allowed for HOST:

     USER-HOST=:

     No restrictions.

     HOST=10.18.100.*

     All hosts from this subnetwork are allowed.

     USER-HOST =*.sap.corp

     All hosts from this network domain are allowed.

     USER-HOST =sapprd,10.18.100.*

     Any size list with no blank lines, separated by commas.

     The following syntax is NOT allowed for HOST:

     USER-HOST =sap*

     Placeholders in host names.

     USER-HOST =10.18.1*.100

     Placeholder in a part of the subnet mask.

     USER-HOST=sapprd, 10.18.100.*

     Any size list separated by commas but with blank lines before or after the commas.

   • Comment: You can add a comment to a standard line. You can use a comment to explain the meaning of a line. The number sign is added automatically.
6. Confirm your input by clicking the Copy Entry icon.