OpenVMS
Notes:
Configuring SSH2 for SFTP, SCP, etc.OpenVMS
Notes:
Configuring SSH2 for SFTP, SCP, etc.Menu
Modes
Programs like SFTP, SFTP2, SCP, SCP2, Secure Telnet, etc. all rely upon SSH (Secure SHell) which means that SSH must be set up and active before you try these other technologies.
If you have ever attempted to use SFTP to do an automated data transfer via a program or script, then you already know that there is no way to provide a password. You might think this is a bug, but it is really a security feature. The creators of SFTP wanted to stop people from placing hard-coded passwords in scripts.
| DCL Command | Notes |
|---|---|
| $sshkeygen /help | this does not work |
| $sshkeygen /ssh1 /help | this does work |
| $sshkeygen /ssh2 /help | this does work |
+---------------------------------------------------+--------------------------------------------------+ | User: SSH_BOB | User: SSH_ALICE | | Node: KAWC09 | Node: KAWC15 | | OS : OpenVMS | OS : OpenVMS | | File: [.ssh2]ssh_bob_on_kawc09 (private half) | File: | | [.ssh2]ssh_bob_on_kawc09.pub (public half) | [.ssh2]ssh_bob_on_kawc09.pub (public half)| | [.ssh2]identification. (control file) | [.ssh2]authorization. (control file)|
| # title: identification. | # title: authorization. |
| # notes: file of private keys | # notes: file of public keys |
| idkey ssh_bob_on_kawc09 | key ssh_bob_on_kawc09.pub | +---------------------------------------------------+--------------------------------------------------+ Notes: 1) Only one key-pair is required to encrypt the connection in both directions (assuming we are not referring to "digital signing" which involves two key-pairs) 2) When BOB connects to Alice, BOB only uses private keys and Alice only uses public keys 3) Therefore, the public key file on BOB's side is not used by BOB. But it needs to be copied to Alice. (do not delete it; you may need to resend it, or you may wish to reuse it elsewhere)
$SET PROC/CASE=SENS/PARSE=EXTENDED ! switch to dangerous mode ...do some case-sensitive work. Like: 1) generating lowercase keys... 2) renaming files from uppercase to lowercaseYou may find these two DCL scripts useful.
$SET PROC/CASE=BLIND/PARSE=TRADITION ! switch back to default OpenVMS mode
================================================================================ Step-01 Interactively log into the local system as SSH_BOB then create a new key-pair ================================================================================ -i-in script: CSMIS$USER3:[ADMCSM.SSH_BOB]LOGIN.COM;15 ! from login script -i-on node : KAWC09 ! from login script -i-exiting : login.com ! from login script KAWC09::SSH_BOB> ! user's DCL prompt KAWC09::SSH_BOB> sshkeygen /ssh2/keys=[.ssh2]SSH_BOB_on_kawc09/nopass/keytype=dsa ! enter this command Generating 1024-bit dsa key pair 1 oOo.oOo.oOo Key generated. 1024-bit dsa, SSH_BOB@kawc09.on.bell.ca, Tue Aug 19 2008 10:37:30 Private key saved to [.SSH2]ssh_bob_on_kawc09 ! private key stays here Public key saved to [.SSH2]ssh_bob_on_kawc09.pub ! public key to distribute KAWC09::SSH_BOB> ! user's DCL prompt ================================================================================ Step-02 Create file "[.ssh2]identification." (tells the client which keys are available) Notes: 1. only use $CREATE if the file doesn't yet exist (use $EDIT instead) 2. otherwise, add the line desired line to the existing file 3. only add entries for private keys located in this directory (some of these public keys may have been copied here from other systems) ================================================================================ KAWC09::SSH_BOB> cre [.ssh2]identification. ! this file has no extension idkey SSH_BOB_on_kawc09 ! entry for a private key file <--- hit <ctrl-z> here ! save the file KAWC09::SSH_BOB> ! user's DCL prompt ================================================================================ Step-03 Copy desired public key(s) to the destination account on remote system Notes: 1. use $scp (secure copy) or $ftp (because $copy only works with DECnet) 2. you will need a password for the remote account 3. if you don't have access to it, then mail this key-file to someone at the remote system who can install it for you 4. if you've read any books on spying or cryptography, this is the step where the ambassador delivers the code keys in a diplomatic pouch. ================================================================================ KAWC09::SSH_BOB> scp [.ssh2]ssh_bob_on_kawc09.pub -
"SSH_ALICE@kawc15.on.bell.ca::[.ssh2]ssh_bob_on_kawc09.pub" Host key not found from database. Key fingerprint: xuhec-habos-durif-tohev-fuzer-cyhip-kydiv-labih-ribyg-posuz-koxyx You can get a public key's fingerprint by running (OpenVMS) $ sshkeygen /ssh2/fingerprint=publickey.pub (UNIX) % ssh-keygen -F publickey.pub on the keyfile. Are you sure you want to continue connecting (yes/no)? yes Host key saved to CSMIS$USER3:[ADMCSM.SSH_BOB.SSH2.HOSTKEYS]key_22_kawc15_on_bell_ca.pub host key for kawc15.on.bell.ca, accepted by SSH_BOB Tue Aug 19 2008 10:58:27 *** WARNING *** THE PROGRAMS AND DATA STORED ON THIS SYSTEM ARE LICENSED TO OR ARE PRIVATE PROPERTY OF THIS COMPANY AND ARE LAWFULLY AVAILABLE ONLY TO AUTHORIZED USERS FOR APPROVED PURPOSES. UNAUTHORIZED ACCESS TO ANY PROGRAM OR DATA ON THIS SYSTEM IS NOT PERMITTED, AND ANY UNAUTHORIZED ACCESS BEYOND THIS POINT MAY LEAD TO PROSECUTION. THIS SYSTEM MAY BE MONITORED AT ANY TIME FOR OPERATIONAL REASONS, THEREFORE, IF YOU ARE NOT AN AUTHORIZED USER, DO NOT ATTEMPT TO LOGIN. SSH_ALICE@kawc15.on.bell.ca's password: ######### ssh_bob_on_kawc09.pub | 751B | 751B/s | TOC: 00:00:01 | 100% <--- copy success KAWC09::SSH_BOB> ! user's DCL prompt ================================================================================ Step-04 set up file "[.ssh2]authorization." on the remote system note: 1) do this in the remote account you wish to use 2) don't use $CREATE if the file already exists (use $EDIT instead) ================================================================================ KAWC09::SSH_BOB> ! user's DCL prompt KAWC09::SSH_BOB> ssh SSH_ALICE@kawc15.on.bell.ca ! enter this command *** WARNING *** THE PROGRAMS AND DATA STORED ON THIS SYSTEM ARE LICENSED TO OR ARE PRIVATE PROPERTY OF THIS COMPANY AND ARE LAWFULLY AVAILABLE ONLY TO AUTHORIZED USERS FOR APPROVED PURPOSES. UNAUTHORIZED ACCESS TO ANY PROGRAM OR DATA ON THIS SYSTEM IS NOT PERMITTED, AND ANY UNAUTHORIZED ACCESS BEYOND THIS POINT MAY LEAD TO PROSECUTION. THIS SYSTEM MAY BE MONITORED AT ANY TIME FOR OPERATIONAL REASONS, THEREFORE, IF YOU ARE NOT AN AUTHORIZED USER, DO NOT ATTEMPT TO LOGIN. SSH_ALICE's password: ######### Authentication successful. Last interactive login on Tuesday, 19-AUG-2008 11:30:44.51 Last non-interactive login on Tuesday, 19-AUG-2008 10:58:35.45 1 login failure since last successful login -i-in script: CSMIS$USER3:[ADMCSM.SSH_ALICE]LOGIN.COM;15 -i-on node : KAWC15 -i-exiting : login.com KAWC15::SSH_ALICE> ! remote user's DCL prompt KAWC15::SSH_ALICE> cre [.ssh2]authorization. ! this file has no extension key ssh_bob_on_kawc09.pub ! entry for a public key file <--- hit <ctrl-z> here ! save the file KAWC15::SSH_ALICE> log ! log out SSH_ALICE logged out at 19-AUG-2008 11:40:49.01 Connection to kawc15.on.bell.ca closed. KAWC09::SSH_BOB> ! local user's prompt
| SSH_BOB (on node: KAWC09) Files: | ||
|---|---|---|
| [.ssh2] file names: | file contents: | notes: |
| identification. | # # title: identification. # idkey ssh_bob_on_kawc09 idkey entry2 idkey entry3 |
1) this file name has no file extension 2) this file contains a list of private keys to offer offer this private key when we connect elsewhere (or this one) (or this one) |
| authorization. | # # title: authorization. # key entry1.pub key entry2.pub key entry3.pub |
1) this file name has no file extension 2) file contains a list of public keys to accept accept this public key when someone connects here (or this one) (or this one) |
| ssh_bob_on_kawc09. |
private key data |
1) this file has no file extension 2) this file was created here 3) it is picked up by the stack after reading "identification." |
| ssh_bob_on_kawc09.pub | public key data | 1) this file has a .pub file extension 2) this file was created here but is copied elsewhere |
| SSH_ALICE (on node: KAWC15) Files: | ||
|---|---|---|
| [.ssh2] file names: | file contents: | notes: |
| identification. | # # title: identification. # idkey entry1 idkey entry2 idkey entry3 |
1) this file name has no file extension 2) this file contains a list of private keys offer this private key when we connect elsewhere (or this one) (or this one) |
| authorization. | # # title: authorization. # key ssh_bob_on_kawc09.pub key entry2.pub key entry3.pub |
1) this file name has no file extension 2) this file contains a list of public keys accept this public key when someone connects here (or this one) (or this one) |
| ssh_bob_on_kawc09.pub | public key data | 1) this file was copied here from
(SSH_BOB on KAWC09) 2) it is picked up by the stack after reading "authorization." |
================================================================================ Step-05 test the ssh2 connection (should no longer require a password) ================================================================================ KAWC09::SSH_BOB> ! user's prompt KAWC09::SSH_BOB> ssh SSH_ALICE@kawc15.on.bell.ca ! connect to SSH_ALICE *** WARNING *** THE PROGRAMS AND DATA STORED ON THIS SYSTEM ARE LICENSED TO OR ARE PRIVATE PROPERTY OF THIS COMPANY AND ARE LAWFULLY AVAILABLE ONLY TO AUTHORIZED USERS FOR APPROVED PURPOSES. UNAUTHORIZED ACCESS TO ANY PROGRAM OR DATA ON THIS SYSTEM IS NOT PERMITTED, AND ANY UNAUTHORIZED ACCESS BEYOND THIS POINT MAY LEAD TO PROSECUTION. THIS SYSTEM MAY BE MONITORED AT ANY TIME FOR OPERATIONAL REASONS, THEREFORE, IF YOU ARE NOT AN AUTHORIZED USER, DO NOT ATTEMPT TO LOGIN. Authentication successful. ! <--- success message Last interactive login on Tuesday, 19-AUG-2008 11:40:17.32 Last non-interactive login on Tuesday, 19-AUG-2008 10:58:35.45 -i-in script: CSMIS$USER3:[ADMCSM.SSH_ALICE]LOGIN.COM;15 ! <--- from script -i-on node : KAWC15 ! <--- from script -i-exiting : login.com ! <--- from script KAWC15::SSH_ALICE> ! <--- yippee
================================================================================ Optional Step-06 Only necessary if you wish to allow connections in the reverse direction ================================================================================ repeat steps-01 through 04 above but in the reverse direction (alice to bob) ================================================================================ step-061 - create a pair of keys for SSH_ALICE on KAWC15 step-062 - create/update file "[.ssh2]identification." for SSH_ALICE on KAWC15 step-063 - copy SSH_ALICE's public key to SSH_BOB on KAWC09 step-064 - create/update file "[.ssh2]authorization." for SSH_BOB on KAWC09
| SSH_ALICE (on node: KAWC15) Files: | ||
|---|---|---|
| [.ssh2] file names: | file contents: | notes: |
| identification. | # # title: identification. # idkey ssh_alice_on_kawc15 idkey entry2 idkey entry3 |
1) this file has no file extension 2) this file contains a list of private keys offer this private key when we connect elsewhere (or this one) (or this one) |
| authorization. | # # title: authorization. # key ssh_bob_on_kawc09.pub key entry2.pub key entry3.pub |
1) this file has no file extension 2) this file contains a list of public keys accept this public key when someone connects here (or this one) (or this one) |
| ssh_alice_on_kawc15. |
private key data |
1) this file has no file extension 2) this file was created here 3) it is picked up by the stack after reading "identification." |
| ssh_alice_on_kawc15.pub | public key data | 1) this file has a .pub file
extension 2) this file was created here but is copied elsewhere |
| ssh_bob_on_kawc09.pub | public key data | 1) this file was copied here from
(SSH_BOB on KAWC09) 2) it is picked up by the stack after reading "authorization." |
| SSH_BOB (on node: KAWC09) Files: | ||
|---|---|---|
| [.ssh2] file names: | file contents: | notes: |
| identification. | # # title: identification. # idkey ssh_bob_on_kawc09 idkey entry2 idkey entry3 |
1) this file has no file extension 2) this file contains a list of private keys offer this private key when we connect elsewhere (or this one) (or this one) |
| authorization. | # # title: authorization. # key ssh_alice_on_kawc15.pub key entry2.pub key entry3.pub |
1) this file has no file extension 2) file contains a list of public keys accept this public key when someone connects here (or this one) (or this one) |
| ssh_bob_on_kawc09. | private key data | 1) this file has no file extension 2) this file was created here 3) it is picked up by the stack after reading "identification." |
| ssh_bob_on_kawc09.pub | public key data | 1) this file has a .pub file extension 2) this file was created here but is copied elsewhere |
| ssh_alice_on_kawc15.pub | public key data | 1) this file was copied here from (SSH_ALICE on KAWC15) 2) it is picked up by the stack after reading "authorization." |
================================================================================ Optional Step-07 (for SSH_BOB on KAWC09) create/update file: "[.ssh2]SSH2_CONFIG." note: 1) unless specified from the command-line, these parameters will be used 2) the second stanza is only necessary if someone tries to connect to kawc15 without using the full DNS name. ================================================================================ kawc15.on.bell.ca: batchmode Y user SSH_ALICE allowedAuthentications publickey kawc15: batchmode Y allowedAuthentications publickey user SSH_ALICE host kawc15.on.bell.ca ================================================================================ Optional Step-08 (for SSH_ALICE on KAWC15) create/update file: "[.ssh2]SSH2_CONFIG." note: 1) unless specified from the command-line, these parameters will be used 2) the second stanza is only necessary if someone tries to connect to kawc09 without using the full DNS name. ================================================================================ kawc09.on.bell.ca: batchmode Y user SSH_BOB allowedAuthentications publickey kawc09: batchmode Y allowedAuthentications publickey user SSH_BOB host kawc09.on.bell.ca
$ dir/prot/width=file=35 Directory CSMIS$ROOT3:[USR.ADMCSM.SSH_BOB.SSH2] authorization.;2 (RWD,RWD,,) HOSTKEYS.DIR;1 (RWD,RWD,,) identification.;4 (RWD,RWD,,) RANDOM_SEED.;1 (RWD,RWD,,) SSH2_CONFIG.TEMPLATE;1 (RWD,RWD,,) ssh_alice_on_kawc15.pub;1 (RWD,RWD,,) ssh_bob_on_kawc09.;1 (RWD,RWD,,) ssh_bob_on_kawc09.pub;1 (RWD,RWD,,)While the broken account looked like this:
$ dir/prot/width=file=35
Directory CSMIS$ROOT4:[CSMIS_ICT_FTP.DATA.SSH2]
AAA_HELP.TXT;1 (RWED,RWED,RWED,RWE) <<<--- much too liberal
authorization.;5 (RWED,RWED,RWED,RWE)
BL1CS9.pub;1 (RWED,RWED,RWED,RWE)
D6BCMS.pub;2 (RWED,RWED,RWED,RWE)
D7PCRW.pub;1 (RWED,RWED,RWED,RWE)
DEMC5S.pub;1 (RWED,RWED,RWED,RWE)
HOSTKEYS.DIR;1 (RWED,RWED,RWED,RWE)
ict_ftp_on_kawc09.;1 (RWED,RWED,RWED,RWE)
ict_ftp_on_kawc09.pub;1 (RWED,RWED,RWED,RWE)
identification.;4 (RWED,RWED,RWED,RWE)
neil_on_kawc15.pub;1 (RWED,RWED,RWED,RWE)
RANDOM_SEED.;1 (RWED,RWED,RWED,RWE)
The Repairs
$ dir/prot [-]ssh2.dir Directory CSMIS$ROOT3:[USR.ADMCSM.SSH_BOB] SSH2.DIR;1 (RWD,RWD,,) Total of 1 file.
One alternative is to modify this file:
SYS$SYSROOT:[TCPWARE.SSH2]SSHD2_CONFIG.
changing line this line:
StrictModes yes
to this:
StrictModes no
but this would reduce security for all ssh2 connections on this platform. It makes more sense to set the file protections to less liberal.
On the flip side, you could create a special config file in you transfer account:
$edit [.ssh2]ssh2_conf.
adding line:
StrictModes no
Many Windows users download GUI-based applications capable of doing SFTP. Then they run into problems and are forced to give up. If you want to go further you'll need to hack (install and play) with OpenSSH. The easiest free way to do this is to install Cygwin then run OpenSSH from that environment. If you can't get SSH working over port 22 (perhaps because a firewall or proxy server is blocking port 22) then SFTP will never work.
Okay so setting up the TCPware flavor of SSH on an OpenVMS platform is pretty straight forward. SSH1 stuff goes into folder [.ssh] whilst SSH2 stuff goes into folder [.ssh2] and most stuff is set up with a text editor.
I recently (2012-04-xx) ran into some problems setting up SSH2 on an older Solaris 9 box (I don't think this thing had been patched ever since it was installed in 2002). I guess our problems started by making the mistake of trying to translate TCPware concepts over to the the Sun box (creating a folder named .ssh2 then populating it with files like authorization etc.). After a couple of wasted hours I decided to peak at file /etc/ssh/ssh_config then execute man ssh , man ssh_config and man ssh-keygen
Caveat what follows may not be present on your Solaris-9 box so be careful
copy neil_on_kawc15_dsa_1024.pub from OpenVMS to UNIX # copy neil_on_kawc15_rsa_1024.pub from OpenVMS to UNIX # cat authorized_keys # see what is in this file cp authorized_keys authorized_keys_backup # make a backup (once per session?) ssh-keygen -X -f neil_on_kawc15_dsa_1024.pub # convert format from SSH2 to OpenSSH (stdout) ssh-keygen -X -f neil_on_kawc15_dsa_1024.pub >> authorized_keys # convert format from SSH2 to OpenSSH (append) ssh-keygen -X -f neil_on_kawc15_rsa_1024.pub # convert format from SSH2 to OpenSSH (stdout) ssh-keygen -X -f neil_on_kawc15_rsa_1024.pub >> authorized_keys # convert format from SSH2 to OpenSSH (append)Note: even though the man pages say this will only work with RSA keys, it appears to work with DSA key as well (old documentation?)
# # extracted from "man ssh_config" # # The values can be changed in per-user configuration files $HOME/.ssh/config # or on the command line of ssh(1). # # Configuration data is parsed as follows: # 1. command line options # 2. user-specific file # 3. system-wide file /etc/ssh/ssh_config # # Any configuration value is only changed the first time it is set. # host-specific definitions should be at the beginning of the # configuration file, and defaults at the end. # DSAAuthentication yes RSAAuthentication yes #LogLevel VERBOSE # only do this to debug problems #StrictModes no # not valid on this OS # # Example (matches compiled in defaults): # # Host * # ForwardAgent no # ForwardX11 no # PubkeyAuthentication yes # PasswordAuthentication yes # FallBackToRsh no # UseRsh no # BatchMode no # CheckHostIP yes # StrictHostKeyChecking ask # EscapeChar ~
On this Solaris box, the man pages provide different information than found in the various apps
| Help | App |
|---|---|
| man ssh | ssh -? |
| man ssh-keygen | ssh-keygen -? |
| man scp | scp -? |
| man sftp | sftp -? |
ssh-keygen -t dsa -b 512 -f vitria77_on_dm4c6h # generate a new key pair
cat vitria77_on_dm4c6h.pub # see OpenSSH formatted file ssh-keygen -e -f vitria77_on_dm4c6h.pub # convert pub key to IETF format (stdout) ssh-keygen -e -f vitria77_on_dm4c6h.pub > vitria77_on_dm4c6h.ietf # convert pub key to IETF format (file) ssh-keygen -x -f vitria77_on_dm4c6h.pub # hacking: -x produces the same result as -e ssh-keygen -x -f vitria77_on_dm4c6h.pub > vitria77_on_dm4c6h.ssh2 # convert pub key to SSH2 format (file) cmp vitria77_on_dm4c6h.ietf vitria77_on_dm4c6h.ssh2 # these files are identical
scp vitria77_on_dm4c6h.ietf account@vms-host.bell.ca:vitria77_on_dm4c6h.ietf
#
Host *
#Host vms-host.bell.ca
#
StrictHostKeyChecking no
PubkeyAuthentication yes
PasswordAuthentication yes
#
# this next line does not appear to work (so is disabled)
#
# IdentityFile2 $HOME/.ssh/vitria77_on_dm4c6h
IdentityFile2 vitria77_on_dm4c6h
LogLevel DEBUG
#
Solaris-9 to VMS-5.5 (TCPware) Transfer Tests ============================================= scp junk.txt system@142.117.38.240:junk.txt - works: (but VMS-5.x will upcase the filename) Here, we want to drop a file into VMS subdirectory sys$login:[.ssh2] ==================================================================== scp junk.txt system@142.117.38.240:./ssh2/junk.txt - works: (but VMS-5.x will upcase the filename) scp junk.txt system@142.117.38.240:/[.ssh2]/ - fails: destination file will be no-name format like this ".;1" scp junk.txt system@142.117.38.240:/[.ssh2]/junk.txt - fails: destination file will be no-name format like this ".;1" scp junk.txt system@142.117.38.240:/[.ssh2]junk.txt - works: (but VMS-5.x will upcase the filename) scp junk.txt system@142.117.38.240:/[.ssh2]Junk.txt - works: (but VMS-5.x will upcase the filename) scp junk.txt system@142.117.38.240:/[.ssh2]*.* - fails: no transfer (lost connection) scp junk.txt system@142.117.38.240:/[.ssh2] - fails: destination file will be no-name format like this ".;1" scp junk.txt system@142.117.38.240:[.ssh2]*.* - fails: no transfer (lost connection) scp junk.txt system@142.117.38.240:[.ssh2] - fails: destination file is $8B.SSH2$8D;1 (not in folder) scp junk.txt system@142.117.38.240:[.ssh2]junk.txt - fails: destination file is $8B.SSH2$8DJUNK$5NTXT;1 (not in folder) Here, we want to drop a file into VMS location disk$spc:[spc] ============================================================= scp junk.txt system@142.117.38.240:/disk$spc/spc/junk.txt - fails: does not work (but creates sub folder [.disk] which is empty) note: the shell noticed "$" and attempted symbol substitution scp junk.txt system@142.117.38.240:/disk\$spc/spc/junk.txt - works: (but VMS-5.x will upcase the filename) note: "\" is used to escape "$" scp junk.txt system@142.117.38.240:/spclib/junk.txt - works: (but VMS-5.x will upcase the filename) note: "spclib" is declared as a system-level logical like so: $ def/sys SPCLIB $1$DIA5:[SPC] scp junk.txt system@142.117.38.240:/spc\$lib/junk.txt - works: (but VMS-5.x will upcase the filename) note: "spc$lib" is declared as a system-level logical like so: $ def/sys SPC$LIB $1$DIA5:[SPC]Apparent Rules:
Personal Comment: I think SFTP is preferable to SCP. That said, this old version of Solaris seems to have no way to force ASC-TEXT transfers from the command line so the conversion may need to be forced by setting a logical at the receiving end.
Back
to
OpenVMS
Back
to Home
Neil Rieck
Kitchener - Waterloo - Cambridge, Ontario, Canada.