> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Appendix A: Protect SAP HANA native backups

> Protect SAP HANA native file backups (BACKUP DATA) on a TDP-encrypted fesfifs mount using the ignore_direct option.

In addition to the data directory, you can protect SAP HANA **native file backups** with TDP. You protect them the same way as the data directory — mount the backup destination with the `ignore_direct` option so backups written by `BACKUP DATA USING FILE` land on an encrypted mount.

## Configure a backup mount

<Steps>
  <Step>
    Create a backing directory for backups and mount it with `ignore_direct` at the SAP HANA backup path. This example uses a backing directory of `/enc/hana-backup` mounted at `/hana/backup`:

    ```bash theme={null}
    sudo mkdir -p /enc/hana-backup
    sudo chown <sid>adm:sapsys /enc/hana-backup
    sudo mount -t fesfifs -o ignore_direct /enc/hana-backup /hana/backup
    ```
  </Step>

  <Step>
    In CryptoHub, add a path rule targeting the **backing directory** for backups, scoped to the SAP HANA user and group:

    * **Path:** `/enc/hana-backup/**`
    * **Groups:** `sapsys`
    * **Users:** `<sid>adm`
  </Step>

  <Step>
    Point the SAP HANA backup destination at the mount path and run a backup:

    ```sql theme={null}
    BACKUP DATA USING FILE ('/hana/backup/<PREFIX>');
    ```

    <Check>
      The backup completes successfully, and the backup entry in `M_BACKUP_CATALOG` shows the state `successful`.
    </Check>
  </Step>
</Steps>

## Verify the backup is encrypted and recoverable

<Steps>
  <Step>
    Confirm the backup files are ciphertext at rest in the backing directory:

    ```bash theme={null}
    sudo head -c 16 /enc/hana-backup/<PREFIX>_databackup_0_1 | od -c
    ```

    <Check>
      The files begin with the `MONADNOCK__SODS` header.
    </Check>
  </Step>

  <Step>
    Confirm the backup is valid and recoverable. `hdbbackupcheck` reads each backup file through the mount, exercising transparent decryption end to end:

    ```bash theme={null}
    sudo -u <sid>adm $DIR_INSTANCE/exe/hdbbackupcheck /hana/backup/<PREFIX>_databackup_0_1
    ```

    <Check>
      The check reports the backup was `successfully checked`.
    </Check>
  </Step>
</Steps>