Skip to main content
Install the Linux TDP agent and the fesfifs kernel module on the SAP HANA host, then point the agent at CryptoHub using the endpoint credentials.

​
Install the agent and driver

1
Copy the TDP agent (ftdp) and the fesfifs-dkms packages to the SAP HANA host.
2
Install both packages. The fesfifs-dkms package builds the fesfifs kernel module for your running kernel.
fesfifs-dkms requires dkms, which is not on the RHEL 9 installation media. On an unregistered or airgapped host, enable EPEL or an equivalent repository that provides dkms first.
3
Confirm the kernel module is present and loadable:

​
Configure the agent for CryptoHub

Transcribe the values from the endpoint bundle into the agent configuration so the agent can authenticate to CryptoHub and receive policy and keys.
1
Place the API key and trust chain from the endpoint bundle into the agent configuration directory (for example, under /etc/futurex/tdp/).
2
Set the CryptoHub host and the service UUID in the agent configuration to match the values from the endpoint bundle.
3
Start the TDP services. The fesfifs-related services are socket-activated, so start the sockets first, then the services:
Start (and restart) the .socket units, not just the .service units. Restarting only the services can remove the runtime socket the agent listens on, which causes policy lookups to fail and files to fall through to unencrypted passthrough.
4
Confirm the agent reached CryptoHub and loaded policy:
A policy cache refreshed message confirms the agent authenticated to CryptoHub and loaded the service policy.
For more on how the TDP agent manages policy and keys, see Agent management and Understanding TDP.