Skip to main content
SAP HANA reads and writes its persistence files through a fesfifs mount, while the files are stored as ciphertext in a backing directory underneath. This page describes how to create that mount for the SAP HANA data directory using the required ignore_direct option.

​
Create the mount

The example below protects the SAP HANA data directory. It uses a backing directory of /enc/hana-data (where ciphertext is stored) and mounts it at the HANA data base path /hana/shared/data (where SAP HANA reads and writes). Adjust both paths to match your deployment.
1
Confirm the backing directory exists and is owned by the SAP HANA administrator user and group:
2
Mount the fesfifs filesystem with the ignore_direct option:
3
Confirm the option took effect. The mount entry reports ignore_direct=true:
The output includes ignore_direct=true, confirming the option is active on the mount.
The backing directory (/enc/hana-data) is the path your CryptoHub path rule must target, as described in Deploy the SAP HANA service. The mount path (/hana/shared/data) is what SAP HANA uses.
Repeat the same pattern for the log volume and native backup directories if you protect them, each with its own backing directory, mount path, and CryptoHub path rule.

​
Place the SAP HANA data directory on the mount

If SAP HANA data already exists at the target path, stop the database, move the existing data aside, mount the encrypted filesystem, and copy the data back in as the SAP HANA administrator user so that it is written through the mount and encrypted. Keep the original copy until you have confirmed the database starts and reads correctly from the encrypted mount. For persistence across reboots, add the mount to /etc/fstab using the fesfifs type and the ignore_direct option, and ensure it mounts before SAP HANA starts.