AWS sap documentation change
Summary
Formatting and syntax corrections in RHEL configuration guide for SAP HANA, including command placeholder standardization, SELinux/GRUB/NTP configuration adjustments, and documentation structure changes.
Security assessment
The changes include uncommenting/modifying commands to disable SELinux (security control) and configure kernel parameters like transparent_hugepage=never. While these impact security configurations, there is no explicit evidence of addressing a specific vulnerability. The adjustments document security-relevant settings but do not directly resolve a disclosed security issue.
Diff
diff --git a/sap/latest/sap-hana/configure-operating-system-rhel-for-sap-7.x.md b/sap/latest/sap-hana/configure-operating-system-rhel-for-sap-7.x.md index 8b21bd268..14a590353 100644 --- a//sap/latest/sap-hana/configure-operating-system-rhel-for-sap-7.x.md +++ b//sap/latest/sap-hana/configure-operating-system-rhel-for-sap-7.x.md @@ -11,2 +10,0 @@ In the following steps, you need to update several configuration files. We recom -###### To configure RHEL 7/8/9 for SAP - @@ -25,2 +23,2 @@ Alternatively, you can use sudo to execute the following commands as ec2-user. - # hostnamectl set-hostname --static your_hostname - # echo "preserve_hostname: true" >> /etc/cloud/cloud.cfg + hostnamectl set-hostname --static <your_hostname> + echo "preserve_hostname: true" >> /etc/cloud/cloud.cfg @@ -32 +30 @@ Open a new session to verify the hostname change. - ip address hostname.example.com hostname + <ip address> <hostname.example.com> <hostname> @@ -36 +34 @@ Ensure that the packages listed in the following SAP Notes (SAP portal access re - * [SAP Note 2002167 \- Red Hat Enterprise Linux 7.x: Installation and Upgrade ](https://launchpad.support.sap.com/#/notes/2002167) + * [SAP Note 2002167 - Red Hat Enterprise Linux 7.x: Installation and Upgrade](https://launchpad.support.sap.com/#/notes/2002167) @@ -38 +36 @@ Ensure that the packages listed in the following SAP Notes (SAP portal access re - * [SAP Note 2772999 \- Red Hat Enterprise Linux 8.x: Installation and Configuration ](https://launchpad.support.sap.com/#/notes/2772999) + * [SAP Note 2772999 - Red Hat Enterprise Linux 8.x: Installation and Configuration](https://launchpad.support.sap.com/#/notes/2772999) @@ -40 +38 @@ Ensure that the packages listed in the following SAP Notes (SAP portal access re - * [SAP Note 3108316 \- Red Hat Enterprise Linux 9.x: Installation and Configuration ](https://launchpad.support.sap.com/#/notes/3108316) + * [SAP Note 3108316 - Red Hat Enterprise Linux 9.x: Installation and Configuration](https://launchpad.support.sap.com/#/notes/3108316) @@ -46 +44 @@ You can use the `rpm` command to check whether a package is installed: - # rpm -qi package_name + rpm -qi <package_name> @@ -50 +48 @@ You can then install any missing packages by using the `yum –y install` comman - # yum -y install package name + yum -y install <package name> @@ -58 +56 @@ Depending on your base RHEL image, additional packages might be required to ensu - # rpm -qi kernel* + rpm -qi kernel* @@ -62 +60 @@ Depending on your base RHEL image, additional packages might be required to ensu - # systemctl start tuned + systemctl start tuned @@ -64 +62 @@ Depending on your base RHEL image, additional packages might be required to ensu - # systemctl enable tuned + systemctl enable tuned @@ -70,2 +68,2 @@ Check whether the `force_latency` parameter is already set in the `/usr/lib/tune - # tuned-adm profile sap-hana - # tuned-adm active + tuned-adm profile sap-hana + tuned-adm active @@ -75,5 +73,5 @@ If the `force_latency` parameter is not set, execute the following steps to modi - # mkdir /etc/tuned/sap-hana - # cp /usr/lib/tuned/sap-hana/tuned.conf /etc/tuned/sap-hana/tuned.conf - # sed -i '/force_latency/ c\force_latency=70' /etc/tuned/sap-hana/tuned.conf - # tuned-adm profile sap-hana - # tuned-adm active + mkdir /etc/tuned/sap-hana + cp /usr/lib/tuned/sap-hana/tuned.conf /etc/tuned/sap-hana/tuned.conf + sed -i '/force_latency/ c\force_latency=70' /etc/tuned/sap-hana/tuned.conf + tuned-adm profile sap-hana + tuned-adm active @@ -83 +81 @@ If the `force_latency` parameter is not set, execute the following steps to modi - # sed -i 's/\(SELINUX=enforcing\|SELINUX=permissive\)/SELINUX=disabled/g' \/etc/selinux/config + sed -i 's/\(SELINUX=enforcing\|SELINUX=permissive\)/SELINUX=disabled/g' \/etc/selinux/config @@ -87,3 +85,3 @@ If the `force_latency` parameter is not set, execute the following steps to modi - # sed -i '/GRUB_CMDLINE_LINUX/ s|"| transparent_hugepage=never"|2' /etc/default/grub - # cat /etc/default/grub - # grub2-mkconfig -o /boot/grub2/grub.cfg + sed -i '/GRUB_CMDLINE_LINUX/ s|"| transparent_hugepage=never"|2' /etc/default/grub + cat /etc/default/grub + grub2-mkconfig -o /boot/grub2/grub.cfg @@ -93,2 +91,2 @@ If the `force_latency` parameter is not set, execute the following steps to modi - # ln -s /usr/lib64/libssl.so.10 /usr/lib64/libssl.so.1.0.1 - # ln -s /usr/lib64/libcrypto.so.10 /usr/lib64/libcrypto.so.1.0.1 + ln -s /usr/lib64/libssl.so.10 /usr/lib64/libssl.so.1.0.1 + ln -s /usr/lib64/libcrypto.so.10 /usr/lib64/libcrypto.so.1.0.1 @@ -102,7 +100,7 @@ Remove any existing invalid NTP server pools from `/etc/ntp.conf` before adding - # echo "server 0.pool.ntp.org" >> /etc/ntp.conf - # echo "server 1.pool.ntp.org" >> /etc/ntp.conf - # echo "server 2.pool.ntp.org" >> /etc/ntp.conf - # echo "server 3.pool.ntp.org" >> /etc/ntp.conf - # systemctl enable ntpd.service - # systemctl start ntpd.service - # systemctl restart systemd-timedated.service + echo "server 0.pool.ntp.org" >> /etc/ntp.conf + echo "server 1.pool.ntp.org" >> /etc/ntp.conf + echo "server 2.pool.ntp.org" >> /etc/ntp.conf + echo "server 3.pool.ntp.org" >> /etc/ntp.conf + systemctl enable ntpd.service + systemctl start ntpd.service + systemctl restart systemd-timedated.service @@ -116,4 +114,4 @@ Instead of connecting to the global NTP server pool, you can connect to your int - # echo "tsc" > /sys/devices/system/clocksource/*/current_clocksource - # cp /etc/default/grub /etc/default/grub.backup - # sed -i '/GRUB_CMDLINE_LINUX/ s|"| clocksource=tsc"|2' /etc/default/grub - # grub2-mkconfig -o /boot/grub2/grub.cfg + echo "tsc" > /sys/devices/system/clocksource/*/current_clocksource + cp /etc/default/grub /etc/default/grub.backup + sed -i '/GRUB_CMDLINE_LINUX/ s|"| clocksource=tsc"|2' /etc/default/grub + grub2-mkconfig -o /boot/grub2/grub.cfg @@ -123,3 +121,2 @@ Instead of connecting to the global NTP server pool, you can connect to your int - # sed -i'.bkp' -e 's/# use_devicesfile = 0/use_devicesfile = 1/g' /etc/lvm/lvm.conf - # mv /etc/lvm/devices/system.devices /etc/lvm/devices/system.devices.bkp - + sed -i'.bkp' -e 's/ use_devicesfile = 0/use_devicesfile = 1/g' /etc/lvm/lvm.conf + mv /etc/lvm/devices/system.devices /etc/lvm/devices/system.devices.bkp @@ -131 +128 @@ Instead of connecting to the global NTP server pool, you can connect to your int - # tuned-adm verify + tuned-adm verify