topic Re: Batch mode FTP over SSL? in Operating System - OpenVMS

Batch mode FTP over SSL?

Duane Sadowski — Wed, 19 Oct 2005 20:56:03 GMT

Hi. I'm trying to find a good way to securely copy data files across the Internet from a VMS system to another organization's non-VMS system. I seek to use a batch job to do the copying, to eliminate the need for human intervention. Two alternative protocols that I'm investigating are SSH and SSL.

Can someone please tell me whether it's feasible to use a VMS 7.3-2 TCP/IP 5.4 system as an FTP-over-SSL (FTPS) client to copy files in batch mode? Would I need to buy an SSL-enabled FTP client program for the VMS system? Is the SSL / FTPS learning curve worse than the SSH learning curve?

I looked at a December 2004 thread in this forum ("SSL Enabled FTP Client for OpenVMS") that sounded relevant, but I didn't find that thread helpful. It seemed to talk about SSH more than SSL. I also did a Google search on comp.os.vms, but I didn't see anything in the threads that I looked at that answered my questions.

- Duane

Re: Batch mode FTP over SSL?

Joseph Huber_1 — Thu, 20 Oct 2005 04:26:56 GMT

Have a look at the free cURL program
http://curl.haxx.se/download.html#VMS

It claims to support FTPS.
(And no, I have no experience with it).

Re: Batch mode FTP over SSL?

Arch_Muthiah — Thu, 20 Oct 2005 13:27:37 GMT

Hi,

There are certain limitations using SFTP and SCP with TCPIP V5.3 and V5.4.

But TCPIP V5.5 seems working fine.

I have pasted those para below which talks about those limitations.

=======================================
3.5.2 SSH File Copy Restrictions
â ¢ On OpenVMS, setting the ForcePTTYAllocation keyword to YES in the
SSH2_CONFIG. file can result in failures when performing file copy operations. (In other implementations of SSH, setting the keyword ForcePTTYAllocation to YES in the SSH2_CONFIG. file has the same effect as using the -t option to the SSH command.)

â ¢ Using the scp and sftp commands from an OpenVMS SSH client to a UNIX
server running OpenSSH is not fully supported because certain operations
cause the OpenVMS client to hang. The hang cannot be terminated by
entering Ctrl/C and Ctrl/Y.

â ¢ File transfer is limited to OpenVMS files with the following record formats
(as displayed by the DIRECTORY/FULL command): STREAM_LF
Fixed-length 512-byte records

â ¢ Not all variants of UNIX path names are supported when referring to files on
OpenVMS clients and servers.

â ¢ Using the SCP and SFTP commands from a non-OpenVMS client may have
unpredictable results, depending on how the client formats the target file
name and whether the client is SSH2 compatible.
============================

And you can also find this filecopy restrictions with SFTP of TCPIP V5.4 from the link below.

http://h71000.www7.hp.com/doc/732FINAL/DOCUMENTATION/PDF/TCPIP054_RELNOTES.PDF

Archunan

Re: Batch mode FTP over SSL?

Duane Sadowski — Thu, 20 Oct 2005 14:45:06 GMT

Joseph:

Thank you for telling me about the cURL program.

I would interested to hear about other people's experiences with cURL on the VMS/Alpha platform.

- Duane

Re: Batch mode FTP over SSL?

Duane Sadowski — Thu, 20 Oct 2005 14:59:46 GMT

Archunan:

Thanks for including that excerpt from the TCP/IP release notes. I will check whether those restrictions are relevant in my configuration. I understood most of the restrictions, and I'll look in the SSH documentation to learn what ForcePTTYAllocation is.

One thing that the excerpt mentions is the file format. I get the sense from other things that I've read that a variety of products ported to VMS favor that file format, so I will also "read the friendly manual" for CONVERT /FDL.

- Duane

Re: Batch mode FTP over SSL?

Duane Sadowski — Thu, 20 Oct 2005 15:03:57 GMT

A follow-up question:

Does it sound fair to say that in the VMS environment, when people want to copy files securely over an insecure medium, it's more common for people to use SSH than to use SSL? I'm getting that impression from the things that I've read on-line, but I want to avoid misrepresenting things.

- Duane

Re: Batch mode FTP over SSL?

Joseph Huber_1 — Fri, 21 Oct 2005 04:32:02 GMT

In my environment (research institutes with international connections), it's scp/sftp mainly because that's what is available on almost every system (mostly Linux).

In the days before ssh/sftp was available, I sometimes used another method maybe of interest to You: using the STUNNEL software, established an SSL encrypted port on both sides, then used standard FTP between these ports.

Knowing the restrictions of sftp, having the full capabilities of FTP maybe an advantage.
It needs setup on both systems/sides though.
Find stunnel on HPs VMS side (I think on open source tools page).

Re: Batch mode FTP over SSL?

Andy Bustamante — Fri, 21 Oct 2005 08:22:41 GMT

Do you have the latest ECO 5 patch update? Check with

$ TCPIP SHOW VERSION

You can download this kit from this site under "suport from Compaq products" if needed.

Andy

Re: Batch mode FTP over SSL?

Ian Miller. — Fri, 21 Oct 2005 09:53:02 GMT

V5.4 ECO 5
ftp://ftp.itrc.hp.com/openvms_patches/layered_products/alpha/DEC-AXPVMS-TCPIP_ECO-V0504-155-4.txt
ftp://ftp.itrc.hp.com/openvms_patches/layered_products/alpha/DEC-AXPVMS-TCPIP_ECO-V0504-155-4.PCSI-DCX_AXPEXE

and stunnel
http://h71000.www7.hp.com/opensource/opensource.html#stunnel

Re: Batch mode FTP over SSL?

Duane Sadowski — Fri, 21 Oct 2005 14:03:11 GMT

Joseph:

Thanks for discussing the reason that you favor scp / sftp in your environment. You mentioned that it's a Linux environment. I think that it might be a Windows system with which I need to communicate, and my impression is that these products are also available for Windows as well.

As for stunnel, I had read about that, in John Wisniewski's book, but I noticed in the release notes for stunnel that "Stunnel cannot be used to secure FTP with TCP/IP v5.3 ECO 2 or later versions". Since I'm running TCP/IP v5.4, I interpret that to mean that I can't use stunnel with the FTP client that comes with HP's TCP/IP and would instead need to find an SSL-enabled FTP client such as the cURL that you mentioned.

- Duane

Re: Batch mode FTP over SSL?

Duane Sadowski — Fri, 21 Oct 2005 14:09:59 GMT

Andy:

Thanks for your reply. No, I don't have ECO 5 installed, and I'm planning to install it soon, since I understand that it's necessary if I want to use SSH to do batch mode copying.

One reason that your reply was helpful is because I was trying to figure out the proper command to tell which TCP/IP ECOs are installed on my system. I had done both a TCPIP SHOW VERSION /ALL and a PRODUCT SHOW HISTORY, and the output of both commands suggested that no ECO has been applied.

- Duane

Re: Batch mode FTP over SSL?

Duane Sadowski — Fri, 21 Oct 2005 14:16:15 GMT

Ian:

Thanks for your help. I'm getting ready to install the TCP/IP v5.4 ECO 5 for which you provided the links.

As for stunnel, as I wrote in a reply above, I read in the release notes that "Stunnel cannot be used to secure FTP with TCP/IP v5.3 ECO 2 or later versions", so it sounds like I can't use that on my system (TCP/IP v5.4).

- Duane

Re: Batch mode FTP over SSL?

Duane Sadowski — Tue, 18 Apr 2006 20:10:10 GMT

Thanks again for the comments. We ended up using SSH (SFTP).