SAF support also available for SSH-Server

Ulrich Schmidt · Post by **Ulrich Schmidt** » Fri Oct 30, 2009 3:19 pm

Hello,

thank you for this SAF-support. I think it's a great idea. I tried to get familiar with it. COZLNCH is running fine.
But I don't see how to associate the keyring to the sftp-client.
And I couldn't figure out whether you also support the ssh-server with this new feature.

brgds,
Ulrich Schmidt

Post by **dovetail** » Fri Oct 30, 2009 3:46 pm

Ulrich,

Thanks for your encouragement.

To use a keyring with the Co:Z SFTP client, you use the "-k" command line switch. The argument to this switch is either "ringname" or "ringname:label". If you only supply the ring name, we use the default certificate in the ring.

Here's an example:
http://dovetail.com/docs/sftp/client.ht ... batch_cert

We are only able to provide this support for the Co:Z SFTP client and the Co:Z launcher, since we are able to use the OpenSSH client's "ssh agent" protocol, which does not require modifications to IBM's ssh client. Adding SAF certificate support to the sftp-server would require modifications to IBM's sshd server.

Kirk Wolf

Ulrich Schmidt · Post by **Ulrich Schmidt** » Sat Oct 31, 2009 2:16 am

Hello Kirk,

sftp works fine, thank you. I the forum for Co:Z SFTP the new version 1.5 wasn't mentioned, so I did not think of trying the brochure.

brgds,
Ulrich

Post by **dovetail** » Sat Oct 31, 2009 10:33 am

Ulrich,

Just curious - are you using existing SAF certificates that you previously used with FTP or did you define new ones?

Also, are you using ICSF with RACF? Are you storing your private key in RACF or ICSF?

Thanks for your feedback.

Ulrich Schmidt · Post by **Ulrich Schmidt** » Mon Nov 02, 2009 4:53 pm

For testing, I used new certificates. I'm thinking, whether I will use the same as I have for ftps but I made no decision right now about this. But it should work with those as well.

We are running ICSF for some reasons. One of those reason is, that RACF cannot store keys larger than 1024 bits - and we got already keys in size 2Kbits. But if we can we store them to the RACFDS. I personnaly feel uncomfortable with those CKDS and PKDS-Dataset; they are too loosly coupled to the security system - you can too easily switch to another dataset and you might loose vital data by doing so.

brgds,
Ulrich Schmidt