SAP Security Profile Parameters Reference (login/*, auth/*, rfc/*)
A lot of SAP security posture sits in profile parameters rather than roles. This reference collects the login, password, authorization, RFC, gateway and audit log parameters that appear most often in hardening checklists and audit programs.
| Parameter | Area | What it controls | Hardening guidance |
|---|---|---|---|
login/min_password_lng | Password | Minimum password length | Set at least 8, many policies require 12 or more |
login/min_password_digits | Password | Minimum number of digits in a password | Set to at least 1 under a complexity policy |
login/min_password_letters | Password | Minimum number of letters in a password | Set to at least 1 under a complexity policy |
login/min_password_specials | Password | Minimum number of special characters | Set to at least 1 under a complexity policy |
login/min_password_uppercase | Password | Minimum number of uppercase letters | Set to at least 1 if your policy requires mixed case |
login/min_password_lowercase | Password | Minimum number of lowercase letters | Set to at least 1 if your policy requires mixed case |
login/password_expiration_time | Password | Days after which dialog passwords expire (0 means no expiry) | Align with company policy, commonly 60 to 90 days, or follow current guidance on long passphrases |
login/password_history_size | Password | Number of previous passwords that cannot be reused | Set to a non zero value in line with policy |
login/password_change_waittime | Password | Days a user must wait before changing the password again | Set to prevent cycling through the history |
login/password_downwards_compatibility | Password | Whether weaker legacy password hashes are still stored and accepted | Set to 0 once all connected systems support the modern hashes |
login/password_hash_algorithm | Password | Algorithm used to hash newly set passwords | Use the stronger setting recommended for your release |
login/fails_to_session_end | Logon | Failed logon attempts before the logon session ends | Keep low, for example 3 |
login/fails_to_user_lock | Logon | Failed attempts before the user is locked | Set between 3 and 5 per policy |
login/failed_user_auto_unlock | Logon | Whether users locked by failed logons are unlocked automatically at midnight | Set to 0 if administrators must unlock after verification |
login/no_automatic_user_sapstar | Logon | Controls whether the hardcoded SAP* fallback is available when the user record is missing | Keep the fallback disabled |
login/disable_multi_gui_login | Logon | Blocks multiple dialog logons with the same user ID | Set to 1 where shared sessions are not allowed, and use login/multi_login_users for exceptions |
login/multi_login_users | Logon | List of users exempt from the multiple logon restriction | Keep this list short and review it |
login/ticket_expire_time | SSO | Validity of SAP logon tickets | Keep short in line with SSO design |
login/accept_sso2_ticket | SSO | Whether this system accepts SAP logon tickets | Enable only on systems that need it |
login/create_sso2_ticket | SSO | Whether this system issues SAP logon tickets | Enable only on the ticket issuing system |
auth/no_check_in_some_cases | Authorization | Allows the profile generator to switch off certain authorization checks via SU24 data | Keep it active unless SAP guidance says otherwise for your release |
auth/object_disabling_active | Authorization | Allows authorization objects to be globally deactivated with SU21 or AUTH_SWITCH_OBJECTS | Set to N in production to prevent global deactivation of checks |
auth/rfc_authority_check | Authorization | Controls the S_RFC authorization check on RFC function module calls | Enable the check (value 1 or higher) for all RFC calls |
rfc/reject_expired_passwd | RFC | Rejects RFC logons with an expired password | Enable it so expired credentials do not silently work through RFC |
gw/sec_info | Gateway | Path of the secinfo file that controls which programs may be started | Maintain it explicitly and avoid wide open entries |
gw/reg_info | Gateway | Path of the reginfo file that controls registration of external servers | Maintain it explicitly and avoid wide open entries |
gw/acl_mode | Gateway | Controls how the gateway behaves when security files are missing | Use the restrictive setting so missing files do not mean open access |
ms/acl_info | Message server | Path of the access control list for message server connections | Restrict to application server hosts |
snc/enable | SNC | Switches Secure Network Communications on | Enable together with the other SNC parameters for encrypted GUI and RFC traffic |
snc/identity/as | SNC | SNC name of the application server | Set according to your security product configuration |
snc/accept_insecure_gui | SNC | Whether GUI logons without SNC are still accepted | Restrict once all clients use SNC |
ssl/ciphersuites | TLS | Allowed TLS cipher suites for the SAP crypto library | Remove weak suites and align with your TLS policy |
icm/server_port_0 | TLS | Defines an ICM port and its protocol, such as HTTPS | Offer HTTPS rather than plain HTTP for logon traffic |
rdisp/gui_auto_logout | Session | Seconds of inactivity before a GUI session is logged off | Set according to policy, for example 1800 to 3600 |
rec/client | Audit | Client specific table change recording (table logging) switch | Enable ALL on production, then select the tables to log |
rsau/enable | Audit | Switches the Security Audit Log on | Enable in production and configure events in SM19 |
rsau/local/file | Audit | File name and path pattern for the local Security Audit Log files | Store on a protected file system and ship to a SIEM |
rsau/max_diskspace/local | Audit | Maximum disk space for Security Audit Log files per instance | Size for your retention needs and archive |
zcsa/system_language | General | Default system language | Informational, not a security control |
Parameter availability, defaults and recommended values differ by kernel and release. Check each parameter with RZ11 on your system and compare against current SAP security guidance before changing anything in production. Static parameters need an instance restart.
Parameter comparison across systems
Optional: ask about a read only comparison of security parameters across your SAP landscape.
Optional. The tool and every export work without this. No spam.
How to use the list
Search by parameter name or by area such as 'gateway' or 'audit'. For each parameter, open RZ11 on your system to see the current value, default and whether it is dynamic. Record both in your own worksheet after exporting to Excel. Parameters are set in the instance or default profile through RZ10, and some can be changed on the fly through RZ11, but the change is lost at restart unless the profile is updated.
- Check the value in RZ11 and the profile file in RZ10
- Compare instance profiles, since differences between servers are common
- Test changes in a non production system first
Reading the guidance column
The guidance column states the direction most hardening guides take, not a mandatory value. Your own password policy, SSO design and regulatory obligations decide the final number. Password and logon parameters directly affect users, so announce changes. Gateway and message server files can break interfaces if tightened without a trace of what actually connects, so use gateway logging to learn real traffic before locking down.
Common mistakes
Frequent problems are a strong password policy set in the default profile but overridden in an instance profile, gateway security files left in a permissive state, and the Security Audit Log enabled but never reviewed or shipped anywhere. Another is changing a dynamic parameter in RZ11 and forgetting to persist it.
- Persist RZ11 changes in the profile
- Do not tighten gateway files without observing interface traffic
- Send audit log events to a monitored location
Frequently Asked Questions
Where do I change SAP profile parameters?
Persistent changes are made in RZ10 in the default, instance or start profile. RZ11 can change dynamic parameters at runtime, but they revert at restart unless also stored in the profile.
What is the difference between the default and instance profile?
The default profile applies to all instances, the instance profile applies to one application server and overrides it. Always check both when a parameter shows an unexpected value.
Do password parameters apply to all user types?
Mostly to dialog users. System, communication and service users have different password handling, so they need separate controls such as ownership and periodic review.
Is there a single correct value for each parameter?
No. Defaults and recommendations change with the release and with your policy. Use the guidance as a starting point and confirm against current SAP documentation and your own risk assessment.
If you want to compare profile parameters across many SAP systems automatically, we can build a read only collector and report that runs inside your network.
Related Tools
SAP Basis Transaction Codes Cheat Sheet
A searchable reference of the SAP Basis, security and system administration transaction codes you use every week, grouped by area.
SAPSAP User Types and Default Users Reference
Look up what each SAP user type allows and how to secure the standard delivered users and clients during an audit or hardening review.
SAPSAP Basis Security Hardening Assessment
Answer ten questions about your SAP system security basics and get a score with the gaps to close first.
SAPSAP Firefighter Emergency Access Request Template
A fill-in emergency access request and post-use review form for SAP firefighter or privileged IDs. Exports to PDF or Word for your audit file.