SSH Tectia

SSH Tectia® Server 6.0 for IBM z/OS

User Manual

Tectia Corporation

This software is protected by international copyright laws. All rights reserved. Tectia® and ssh® are registered trademarks of Tectia Corporation in the United States and in certain other jurisdictions. The Tectia and SSH logos are trademarks of Tectia Corporation and may be registered in certain jurisdictions. All other names and marks are property of their respective owners.

No part of this publication may be reproduced, published, stored in an electronic database, or transmitted, in any form or by any means, electronic, mechanical, recording, or otherwise, for any purpose, without the prior written permission of Tectia Corporation.


For Open Source Software acknowledgements, see appendix Open Source Software License Acknowledgements in the Product Description.

18 January 2011

Table of Contents

1. About This Document
Documentation Conventions
Operating System Names
Customer Support
Component Terminology
2. Getting Started
Product Components
Environment Variables for Client Applications
Running Client Programs
Under USS
Under MVS
Running Connection Broker
Starting ssh-broker-g3 Manually under USS
Running ssh-broker-g3 as a Started Task
Stopping ssh-broker-g3
Reconfiguring ssh-broker-g3
Connecting to a Remote Host
Authenticating Remote Server Hosts
Using Password Authentication
Using Public-Key Authentication
Logging in with Command-Line sshg3
3. Configuring Client Tools
Client Configuration Files
Editing the Configuration Files
Environment Variables
Command-Line Options
Configuration File for Connection Broker and SOCKS Proxy
4. Authentication
Server Authentication with Public Keys in File
Host Key Storage Formats
Using the System-Wide Host Key Storage
Using the OpenSSH known_hosts File
Server Authentication with Certificates
CA Certificates Stored in File
CA Certificates Stored in SAF
Server Certificates Stored in SAF
User Authentication with Passwords
Password in File or Dataset
User Authentication with Public Keys in File
Creating Keys with ssh-keygen-g3 on z/OS
Uploading Public Keys from z/OS to Remote Host
Using Keys Generated with OpenSSH
Special Considerations with Windows Servers
User Authentication with Certificates
Certificates Stored in File
Certificates Stored in SAF
Host-Based User Authentication
User Authentication with Keyboard-Interactive
Distributing Public Keys Using the Key Distribution Tool
Fetching Remote Server Keys
Distributing Mainframe User Keys
5. Secure File Transfer Using SFTP
Secure File Transfer with scpg3 and sftpg3 Commands
Using scpg3
Using sftpg3
Enhanced File Transfer Functions
Handling MVS Datasets and HFS File System Access
Dataset and HFS File System Access
Dataset Access Using DD Cards
Accessing Generation Data Groups (GDG)
Controlling File Transfer
Site Command
File Transfer Environment Variables for the Clients
Listing Datasets with SSH Tectia client tools for z/OS
Dataset Lists
Dataset Hierarchy
Secure File Transfer Examples Using the z/OS Client
Interactive File Transfers
Unattended File Transfers
File Transfers Using REXX Scripts and a JCL Procedure
6. System Administration
Running Remote Commands
Remote Command Examples from USS
Remote Command Examples using JCL
Submitting JCL Jobs over Secure Shell
Securing the Client
Disabling Agent Forwarding
7. Secure Shell Tunneling
Local Tunnels
Non-Transparent TCP Tunneling
Non-Transparent FTP Tunneling
SOCKS Tunneling
Remote Tunnels
Agent Forwarding
8. Troubleshooting SSH Tectia
Starting Connection Broker in Debug Mode
Solving Problem Situations
9. Using Other Secure Shell Clients
Using Public-Key Authentication from Other Hosts to z/OS
From SSH Tectia Client on Windows to SSH Tectia Server on z/OS
From SSH Tectia Client on Unix to SSH Tectia Server on z/OS
From OpenSSH Client on Unix to SSH Tectia Server on z/OS
Handling MVS Datasets and HFS File System Access
Dataset and HFS File System Access
Accessing Generation Data Groups (GDG)
Alternate Methods for Controlling File Transfer
Advice String
File Transfer Profiles
Site Command Examples with Other Clients
File Transfer Environment Variables for the Server
Listing Datasets with Other SFTP Clients
Dataset Lists
Dataset Hierarchy
Secure File Transfer Examples Using Windows and Unix Clients
File Transfers Using Windows GUI
File Transfers Using Command-Line Applications
File Transfers Using FTP-SFTP Conversion
A. Broker Configuration File Syntax
B. Command-Line Tools
ssh-broker-g3 - SSH Connection Broker - Generation 3
ssh-broker-ctl - SSH Tectia Connection Broker control utility
sshg3 - Secure Shell terminal client - Generation 3
scpg3 - Secure Shell file copy client - Generation 3
sftpg3 - Secure Shell file transfer client - Generation 3
ssh-sft-stage - stage and destage MVS datasets and HFS files
ssh-keygen-g3 - authentication key pair generator
ssh-keydist-g3 - Key distribution tool
ssh-keyfetch - Host key tool for the Secure Shell client
ssh-cmpclient-g3 - CMP enrollment client
ssh-scepclient-g3 - SCEP enrollment client
ssh-certview-g3 - certificate viewer
ssh-ekview-g3 - external key viewer
C. Egrep Syntax
Egrep Patterns
Escaped Tokens for Regex Syntax Egrep
Character Sets For Egrep
D. Audit Messages