> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Mount the encrypted filesystem for SAP HANA

> Mount the fesfifs encrypted filesystem with the ignore_direct option so SAP HANA can write its data directory through TDP.

SAP HANA reads and writes its persistence files through a `fesfifs` mount, while the files are stored as ciphertext in a backing directory underneath. This page describes how to create that mount for the SAP HANA **data directory** using the required `ignore_direct` option.

## Create the mount

The example below protects the SAP HANA data directory. It uses a backing directory of `/enc/hana-data` (where ciphertext is stored) and mounts it at the HANA data base path `/hana/shared/data` (where SAP HANA reads and writes). Adjust both paths to match your deployment.

<Steps>
  <Step>
    Confirm the backing directory exists and is owned by the SAP HANA administrator user and group:

    ```bash theme={null}
    sudo mkdir -p /enc/hana-data
    sudo chown <sid>adm:sapsys /enc/hana-data
    ```
  </Step>

  <Step>
    Mount the `fesfifs` filesystem with the `ignore_direct` option:

    ```bash theme={null}
    sudo mount -t fesfifs -o ignore_direct /enc/hana-data /hana/shared/data
    ```
  </Step>

  <Step>
    Confirm the option took effect. The mount entry reports `ignore_direct=true`:

    ```bash theme={null}
    mount | grep /hana/shared/data
    ```

    <Check>
      The output includes `ignore_direct=true`, confirming the option is active on the mount.
    </Check>
  </Step>
</Steps>

<Note>
  The backing directory (`/enc/hana-data`) is the path your CryptoHub path rule must target, as described in [Deploy the SAP HANA service](/Integrations/CryptoHub/Database/SAP_HANA/Deploy_the_SAP_HANA_service). The mount path (`/hana/shared/data`) is what SAP HANA uses.
</Note>

Repeat the same pattern for the log volume and native backup directories if you protect them, each with its own backing directory, mount path, and CryptoHub path rule.

## Place the SAP HANA data directory on the mount

If SAP HANA data already exists at the target path, stop the database, move the existing data aside, mount the encrypted filesystem, and copy the data back in **as the SAP HANA administrator user** so that it is written through the mount and encrypted. Keep the original copy until you have confirmed the database starts and reads correctly from the encrypted mount.

For persistence across reboots, add the mount to `/etc/fstab` using the `fesfifs` type and the `ignore_direct` option, and ensure it mounts before SAP HANA starts.