Batch mode FTP over SSL?

[Duane Sadowski]

Hi. I'm trying to find a good way to securely copy data files across the Internet from a VMS system to another organization's non-VMS system. I seek to use a batch job to do the copying, to eliminate the need for human intervention. Two alternative protocols that I'm investigating are SSH and SSL.

Can someone please tell me whether it's feasible to use a VMS 7.3-2 TCP/IP 5.4 system as an FTP-over-SSL (FTPS) client to copy files in batch mode? Would I need to buy an SSL-enabled FTP client program for the VMS system? Is the SSL / FTPS learning curve worse than the SSH learning curve?

I looked at a December 2004 thread in this forum ("SSL Enabled FTP Client for OpenVMS") that sounded relevant, but I didn't find that thread helpful. It seemed to talk about SSH more than SSL. I also did a Google search on comp.os.vms, but I didn't see anything in the threads that I looked at that answered my questions.

- Duane

[Joseph Huber_1]

Have a look at the free cURL program
http://curl.haxx.se/download.html#VMS

It claims to support FTPS.
(And no, I have no experience with it).

[Arch_Muthiah]

Hi,

There are certain limitations using SFTP and SCP with TCPIP V5.3 and V5.4.

But TCPIP V5.5 seems working fine.

I have pasted those para below which talks about those limitations.

=======================================
3.5.2 SSH File Copy Restrictions
â ¢ On OpenVMS, setting the ForcePTTYAllocation keyword to YES in the
SSH2_CONFIG. file can result in failures when performing file copy operations. (In other implementations of SSH, setting the keyword ForcePTTYAllocation to YES in the SSH2_CONFIG. file has the same effect as using the -t option to the SSH command.)

â ¢ Using the scp and sftp commands from an OpenVMS SSH client to a UNIX
server running OpenSSH is not fully supported because certain operations
cause the OpenVMS client to hang. The hang cannot be terminated by
entering Ctrl/C and Ctrl/Y.

â ¢ File transfer is limited to OpenVMS files with the following record formats
(as displayed by the DIRECTORY/FULL command): STREAM_LF
Fixed-length 512-byte records

â ¢ Not all variants of UNIX path names are supported when referring to files on
OpenVMS clients and servers.

â ¢ Using the SCP and SFTP commands from a non-OpenVMS client may have
unpredictable results, depending on how the client formats the target file
name and whether the client is SSH2 compatible.
============================

And you can also find this filecopy restrictions with SFTP of TCPIP V5.4 from the link below.

http://h71000.www7.hp.com/doc/732FINAL/DOCUMENTATION/PDF/TCPIP054_RELNOTES.PDF

Archunan

[Duane Sadowski]

Joseph:

Thank you for telling me about the cURL program.

I would interested to hear about other people's experiences with cURL on the VMS/Alpha platform.

- Duane

[Duane Sadowski]

Archunan:

Thanks for including that excerpt from the TCP/IP release notes. I will check whether those restrictions are relevant in my configuration. I understood most of the restrictions, and I'll look in the SSH documentation to learn what ForcePTTYAllocation is.

One thing that the excerpt mentions is the file format. I get the sense from other things that I've read that a variety of products ported to VMS favor that file format, so I will also "read the friendly manual" for CONVERT /FDL.

- Duane

[Duane Sadowski]

A follow-up question:

Does it sound fair to say that in the VMS environment, when people want to copy files securely over an insecure medium, it's more common for people to use SSH than to use SSL? I'm getting that impression from the things that I've read on-line, but I want to avoid misrepresenting things.

- Duane

[Joseph Huber_1]

In my environment (research institutes with international connections), it's scp/sftp mainly because that's what is available on almost every system (mostly Linux).

In the days before ssh/sftp was available, I sometimes used another method maybe of interest to You: using the STUNNEL software, established an SSL encrypted port on both sides, then used standard FTP between these ports.

Knowing the restrictions of sftp, having the full capabilities of FTP maybe an advantage.
It needs setup on both systems/sides though.
Find stunnel on HPs VMS side (I think on open source tools page).

[Andy Bustamante]

Do you have the latest ECO 5 patch update? Check with

$ TCPIP SHOW VERSION

You can download this kit from this site under "suport from Compaq products" if needed.

Andy

[Ian Miller.]

V5.4 ECO 5
ftp://ftp.itrc.hp.com/openvms_patches/layered_products/alpha/DEC-AXPVMS-TCPIP_ECO-V0504-155-4.txt
ftp://ftp.itrc.hp.com/openvms_patches/layered_products/alpha/DEC-AXPVMS-TCPIP_ECO-V0504-155-4.PCSI-DCX_AXPEXE

and stunnel
http://h71000.www7.hp.com/opensource/opensource.html#stunnel

[Duane Sadowski]

Joseph:

Thanks for discussing the reason that you favor scp / sftp in your environment. You mentioned that it's a Linux environment. I think that it might be a Windows system with which I need to communicate, and my impression is that these products are also available for Windows as well.

As for stunnel, I had read about that, in John Wisniewski's book, but I noticed in the release notes for stunnel that "Stunnel cannot be used to secure FTP with TCP/IP v5.3 ECO 2 or later versions". Since I'm running TCP/IP v5.4, I interpret that to mean that I can't use stunnel with the FTP client that comes with HP's TCP/IP and would instead need to find an SSL-enabled FTP client such as the cURL that you mentioned.

- Duane