Appendix A: Protect SAP HANA native backups

In addition to the data directory, you can protect SAP HANA native file backups with TDP. You protect them the same way as the data directory — mount the backup destination with the ignore_direct option so backups written by BACKUP DATA USING FILE land on an encrypted mount.

Configure a backup mount

Create a backing directory for backups and mount it with ignore_direct at the SAP HANA backup path. This example uses a backing directory of /enc/hana-backup mounted at /hana/backup:

sudo mkdir -p /enc/hana-backup
sudo chown <sid>adm:sapsys /enc/hana-backup
sudo mount -t fesfifs -o ignore_direct /enc/hana-backup /hana/backup

In CryptoHub, add a path rule targeting the backing directory for backups, scoped to the SAP HANA user and group:

Path: /enc/hana-backup/**
Groups: sapsys
Users: <sid>adm

Point the SAP HANA backup destination at the mount path and run a backup:

BACKUP DATA USING FILE ('/hana/backup/<PREFIX>');

The backup completes successfully, and the backup entry in M_BACKUP_CATALOG shows the state successful.

Verify the backup is encrypted and recoverable

Confirm the backup files are ciphertext at rest in the backing directory:

sudo head -c 16 /enc/hana-backup/<PREFIX>_databackup_0_1 | od -c

The files begin with the MONADNOCK__SODS header.

Confirm the backup is valid and recoverable. hdbbackupcheck reads each backup file through the mount, exercising transparent decryption end to end:

sudo -u <sid>adm $DIR_INSTANCE/exe/hdbbackupcheck /hana/backup/<PREFIX>_databackup_0_1

The check reports the backup was successfully checked.

⌘I

​Configure a backup mount

​Verify the backup is encrypted and recoverable

Configure a backup mount

Verify the backup is encrypted and recoverable