SICF services to be disabled

Some SICF services might be activated from the past. For security they might pose a risk. The best action is to pro-actively disable them.

/sap/bc/bsp/sap/bsp_veri
/sap/bc/bsp/sap/certmap
/sap/bc/gui/sap/its/CERTMAP
/sap/bc/bsp/sap/certreq
/sap/bc/gui/sap/its/CERTREQ
/sap/bc/echo
/sap/bc/error
/sap/bc/FormToRfc
/sap/bc/bsp/sap/icf
/sap/bc/srt/IDoc
/sap/bc/idoc_xml
/sap/bc/report
/sap/bc/soap/rfc
/sap/bc/webrfc
/sap/bc/xrfc
/sap/bc/xrfc_test
1422273
*1417568
1417568
*1417568
1417568
626073
626073
626073
1422273
*1487606
1487606
626073
1394100
979467
626073
626073
Remarks on the (*): these services still might have a business need, double check these before de-activating.

Critical services according to note 887164:
/sap/bc/bsp/sap/bsp_model
/sap/bc/bsp/sap/htmlb_samples
/sap/bc/bsp/sap/it00
/sap/bc/bsp/sap/it01
/sap/bc/bsp/sap/it02
/sap/bc/bsp/sap/it03
/sap/bc/bsp/sap/it04
/sap/bc/bsp/sap/it05
/sap/bc/bsp/sap/itmvc2
/sap/bc/bsp/sap/itsm
/sap/bc/bsp/sap/sbspext_htmlb
/sap/bc/bsp/sap/sbspext_phtmlb
/sap/bc/bsp/sap/sbspext_table (see note 2948239)
/sap/bc/bsp/sap/sbspext_xhtmlb
/sap/bc/bsp/sap/system_private
/sap/bc/bsp/sap/system_public

Source: SAP security baseline.

SICF tips and trikcs

SICF is an abbreviation for SAP internet communication framework.

It is used to expose internet services like SAP ABAP webdynpro, ODATA etc.

Checking active services

As per SAP “Note 1555208 – ICF services become inactive after upgrade or SP update” you can find the list of active services with the report RS_ICF_SERV_ADMIN_TASKS (choose option Export of Active Services into CSV file).

On table level: Check the table ICFSERVLOC. All active services are marked with an “X” flag.

Checking SICF security settings

Don’t use the old program RSICFCHK (see OSS note 3300857 – Report RSICFCHK shows incomplete result). Use the new SECSTORE transaction. At the start of transaction SECSTORE choose in the check entries section “ICF Service”:

Now hit execute and check the results:

Mass processing

SICF mass processing is done via program RS_ICF_SERV_MASS_PROCESSING.

Logging of SICF changes

To enable logging of SICF changes: switch on table logging for table ICFSERVLOC.

HTTP whitelisting

Some issues with web applications are caused by (incorrect) whitelisting. HTTP whitelisting setup is explained in OSS note 2578665 – How to maintain the table HTTP_WHITELIST.

Various OSS notes around SICF