TCPware FAQ: SSH

 

Is there a way to control who can SSH and who can not?

The AllowHosts, AllowSHosts, DenyHosts, and DenySHosts keywords in the TCPWARE:SSHD_CONFIG. file can be used to control what hosts can access the system. See the Configuration File Keywords table in the Administrator's Guide.


What is the difference between SSH v2 and SSH v1 protocol?

SSH1 and SSH2 are different, and incompatible, protocols. While SSH v2 is generally regarded to be more secure than SSH v1, both protocols are offered by the TCPware SSH server, and although they are incompatible, they may exist simultaneously on an SSH for OpenVMS system. The server front-end identifies what protocol a client desires to use, and will create an appropriate server for that client.


Which applications can I secure besides Telnet and the R services?

Port forwarding allows forwarding of TCP/IP connections to a remote machine over an encrypted channel. A local proxy server is created for a remote TCP/IP service. The service can be one of the Internet protocols: POP, SMTP (used by e-mail software), HTTP (used by Web browsers), TCP/IP connection to an RDBMS server, or almost any other TCP/IP based service provided the port is known via a static assignment. The local proxy server listens for a socket on the desired port, forwards the request and data over the secure channel, and instructs the SSH server to make the connection to the specified service on the remote machine. The only noticeable change is that the client software is configured to connect to the local proxy server rather that the remote server.


Which encryption ciphers are supported?

SSH Cipers SSHv1 SSHv2
3DES (112 bit)
Archfour (128 bit)
BlowFish (128 bit)
DES (56 bit)
IDEA (128 bit)
TwoFish (256 bit)
AES (128, 192, 256 bit)
Cast-128 (128 bit)

When I do an ls command to some SFTP servers (on UNIX systems), the list of files is not alphabetized, but on others it is. Why?

The SFTP client lists the files in the order that it receives them from the SFTP server, and the SFTP server delivers names in the order that they are received from the operating system. If the operating system keeps the names sorted (VMS does), then the list of file names will be in alphabetical order.

Why do I have problems with version numbers (or wildcards for version numbers) when in VMS mode?

Displaying multiple versions of files is controlled by the logical TCPWARE_SFTP_VMS_ALL_VERSIONS. If this logical is defined to TRUE, then all versions of files are displayed in directory commands. The default value is FALSE. Version numbers are not included with the filename if only the most recent version is being displayed.


I connected to a system running an earlier version of Process Software's SFTP server and VMS transfer mode was not automatically negotiated.

Older versions of the SFTP server do not provide the information that the SFTP2 client needs to see that VMS mode is available unless they have been set to translate by default (DEFINE TCPWARE_SFTP_TRANSLATE_VMS_FILE_TYPES 7).


Why is the directory from a VMS system presented in UNIX format when VMS transfer mode is not in use?

In order to present filenames in a consistent format, they are only displayed as VMS filenames when VMS transfers are in use. When binary or ASCII transfers are in use, filenames are presented in UNIX format.


Why do the filenames on my VMS system have $ characters in them?

On ODS-2 disks the filenames are SRI encoded to preserve case and other special characters. For ODS-5, the logical TCPWARE_SFTP_USE_SRI_ENCODING_ON_ODS5 controls will cause SRI encoding to be used if it is defined to be TRUE (the default value is FALSE).


Why doesn't SFTP2 have a TRANSLATE mode like SCP2 does?

The TRANSLATE_VMS qualifier was a method of providing ASCII (text) transfers when they were not available. It was felt that it was not necessary since SFTP2 has ASCII (text) transfers.


I am using WinSCP on my PC and it won't work with the VMS system. Why?

In order for WinSCP to work with the VMS system, the following UNIX commands must be placed in the path: alias, cd, chgrp, chmod, chown, echo, groups, ls, mkdir, mv, pwd, scp, rm, unalias, and unset. The user must have sufficient permissions to execute these UNIX commands. Because VMS doesn't have these commands, WinSCP will not work with the VMS SFTP server.


I've enabled the SSH server to do SSH1 but not SSH2 and my attempts to use SFTP fail. Why?

SSH2 must be enabled to use SFTP.


How can I configure TCPware's SSH server to ignore client connection requests from addresses which are not in some sort of "approved" list?

You can use packet filtering to block those. The following set of rules would only allow connections from the 192.42.95.0/24 subnet and the host 198.115.48.1 -

permit tcp 192.42.95.0 255.255.255.0 0 0 eq 22
permit tcp 198.115.48.1 255.255.255.255 eq 22 drop tcp 0 0 0 0 eq 22

Is there a way to identify whether a user's current interactive session is connected via SSH1 rather than SSH2 so that a message can be displayed?

The existence of the TCPWARE_SSH_PID_DEVICE logical (where PID is the PID of the process) in the LNM$SSH_LOGICALS table indicates the connection is via SSH1 rather than SSH2.


Can you change the port the SSH server listens on?

Yes, perform a @TCPWARE:CNFNET SSH and entering the new port number when prompted.


How can I avoid the SSHD.LOG file version number reaching 32768?

When an SSH connection is formed, the SSHD Master server process creates an SSH server process and hands off the connection. The SSH server process creates a pseudo terminal and runs LOGINOUT.EXE on it to create a session process for carrying out the requested command or handling the interactive session. These activities are logged in an SSHD.LOG file by default, but over time, this can create problems, as the version number eventually increments to the maximum value of 32768.

Purging the SSHD.LOG files can be problematic, as those with active connections will be locked and can't be deleted without closing the related sessions. In some cases connections can stay active for days or weeks.

There is support available for changing the name of the SSHD log file by defining a logical name to have a value that specifies the form that the log file names should take. In TCPware, the logical is TCPWARE_SSH_LOG_FILE.

The logical is defined /SYSTEM and /EXECUTIVE. In the logical's equivalence value, the following tokens can be used, and will be substituted with the associated meaning at the time a log file is being created:

  • %D - date in yyyymmdd format
  • %N - system SCS node name
  • %C - an incrementing sequence number

For example:

$ DEFINE/SYSTEM/EXECUTIVE MULTINET_SSH_LOG_FILE "SSH_LOG:SSHD_%N_%D-%C.LOG"

This will result in SSHD log files with names such as SSHD_SYSA_20210901-1.LOG

You are not required to use any of the tokens in this renaming mechanism. If you do use them, you can use just those that you require.

Setting up an alternate naming pattern for the log files should remove the version number limit problem if you incorporate at least the date token. The disadvantage of naming the log files this way is that you have to manage (i.e. delete) old files so that they don't fill up the directory/disk over time. A periodic batch job that deletes logs older than some delta time in the past is one solution.