The following is an example of performing an anonymous SFTP upload of a file to IBM Enhanced Customer Data Repository using a line mode SFTP client. Of course you can use any SFTP client.

The following is an example of performing an anonymous FTP upload of a file to IBM Enhanced Customer Data Repository using a line mode FTP client. Of course you can use any FTP client.

The following JCL can be tailored and used to process the data sets to be transmitted to the FTP server.

Note: Please be sure to TURN OFF the LINE NUMBERING.

Where
TRS - Mandatory identifier for tersed files
EFZ - Identifier only for encrypted files

When using Secure FTP (FTPS) it is possible that you will get problems with your firewall. This is due to the nature of the protocol and the different types of firewalls.

FTP uses two connections between the FTP client and FTP server. The control connection is used to exchange FTP commands and control information, and the data connection is used to transmit the files and for output of commands.

The control connection is established when an FTP client connects an FTP server. If data has to be transfered, the data connection is set up dynamically. There are no fixed TCP ports which are used for this connection. The FTP server tells the client the TCP port to be used within the control connection. The port changes for every data transmission. Modern firewalls read the port information exchanged within the control connection and dynamically create rules to allow the data transfer.

While FTPS is in use, the control and data connection is encrypted. A firewall can no longer read the content of the control connection and dynamic rule creation for the data connections is no longer possible.

There are also some firewalls which run more or less intensive checks on the traffic within the control connections. They drop the connection if they detect traffic which is not mentioned in the FTP protocol definition. Those checks must fail with encrypted connections.

In case of problems please read our help page.

MVS (OS/390, z/OS) FTP Clients only

Please follow the directives below to establish the necessary RACF definition.

1. Obtain the Equifax CA certificate.
   • Below you will find the contents of the CURRENT Equifax CA certificate. Please note that this certificate is subject to change, i.e., it may get invalid or it may expire.
   • You can find the ORIGINAL certificate on the GeoTrust webpage under Web Security, SSL certificates, TrueBusiness ID, Installation Instructions, or you can use this link for the certificate and installation.
   • Follow the link IBM-HTTP, ignore all references to the HTTP server, the certificate is at the bottom.
   • Current contents of the GeoTrust Trusted Root Certificate: Equifax Secure Certificate Authority
     
     

     -----BEGIN CERTIFICATE-----
     MIIDIDCCAomgAwIBAgIENd70zzANBgkqhkiG9w0BAQUFADBOMQswCQYDVQQGEwJV
     UzEQMA4GA1UEChMHRXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUgQ2Vy
     dGlmaWNhdGUgQXV0aG9yaXR5MB4XDTk4MDgyMjE2NDE1MVoXDTE4MDgyMjE2NDE1
     MVowTjELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0VxdWlmYXgxLTArBgNVBAsTJEVx
     dWlmYXggU2VjdXJlIENlcnRpZmljYXRlIEF1dGhvcml0eTCBnzANBgkqhkiG9w0B
     AQEFAAOBjQAwgYkCgYEAwV2xWGcIYu6gmi0fCG2RFGiYCh7+2gRvE4RiIcPRfM6f
     BeC4AfBONOziipUEZKzxa1NfBbPLZ4C/QgKO/t0BCezhABRP/PvwDN1Dulsr4R+A
     cJkVV5MW8Q+XarfCaCMczE1ZMKxRHjuvK9buY0V7xdlfUNLjUA86iOe/FP3gx7kC
     AwEAAaOCAQkwggEFMHAGA1UdHwRpMGcwZaBjoGGkXzBdMQswCQYDVQQGEwJVUzEQ
     MA4GA1UEChMHRXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUgQ2VydGlm
     aWNhdGUgQXV0aG9yaXR5MQ0wCwYDVQQDEwRDUkwxMBoGA1UdEAQTMBGBDzIwMTgw
     ODIyMTY0MTUxWjALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAUSOZo+SvSspXXR9gj
     IBBPM5iQn9QwHQYDVR0OBBYEFEjmaPkr0rKV10fYIyAQTzOYkJ/UMAwGA1UdEwQF
     MAMBAf8wGgYJKoZIhvZ9B0EABA0wCxsFVjMuMGMDAgbAMA0GCSqGSIb3DQEBBQUA
     A4GBAFjOKer89961zgK5F7WF0bnj4JXMJTENAKaSbn+2kmOeUJXRmm/kEd5jhW6Y
     7qj/WsjTVbJmcVfewCHrPSqnI0kBBIZCe/zuf6IWUrVnZ9NA2zsmWLIodz2uFHdh
     1voqZiegDfqnc1zqcPGUIWVEX/r87yloqaKHee9570+sB3c4
     -----END CERTIFICATE-----
     

     
     
   • Use Copy and Paste to place this Certificate into a SEQUENTIAL, VARIABLE BLOCKED dataset on your MVS System, be sure to include the top and bottom dashed lines.
   • Name this dataset SYS1.CA.CERT.
   • Do NOT change the contents!
2. New intermediate certificates
   

   Subject: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA

   
   
   
   

   -----BEGIN CERTIFICATE-----
   MIIDfTCCAuagAwIBAgIDErvmMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlVT
   MRAwDgYDVQQKEwdFcXVpZmF4MS0wKwYDVQQLEyRFcXVpZmF4IFNlY3VyZSBDZXJ0
   aWZpY2F0ZSBBdXRob3JpdHkwHhcNMDIwNTIxMDQwMDAwWhcNMTgwODIxMDQwMDAw
   WjBCMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEbMBkGA1UE
   AxMSR2VvVHJ1c3QgR2xvYmFsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
   CgKCAQEA2swYYzD99BcjGlZ+W988bDjkcbd4kdS8odhM+KhDtgPpTSEHCIjaWC9m
   OSm9BXiLnTjoBbdqfnGk5sRgprDvgOSJKA+eJdbtg/OtppHHmMlCGDUUna2YRpIu
   T8rxh0PBFpVXLVDviS2Aelet8u5fa9IAjbkU+BQVNdnARqN7csiRv8lVK83Qlz6c
   JmTM386DGXHKTubU1XupGc1V3sjs0l44U+VcT4wt/lAjNvxm5suOpDkZALeVAjmR
   Cw7+OC7RHQWa9k0+bw8HHa8sHo9gOeL6NlMTOdReJivbPagUvTLrGAMoUgRx5asz
   PeE4uwc2hGKceeoWMPRfwCvocWvk+QIDAQABo4HwMIHtMB8GA1UdIwQYMBaAFEjm
   aPkr0rKV10fYIyAQTzOYkJ/UMB0GA1UdDgQWBBTAephojYn7qwVkDBF9qn1luMrM
   TjAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjA6BgNVHR8EMzAxMC+g
   LaArhilodHRwOi8vY3JsLmdlb3RydXN0LmNvbS9jcmxzL3NlY3VyZWNhLmNybDBO
   BgNVHSAERzBFMEMGBFUdIAAwOzA5BggrBgEFBQcCARYtaHR0cHM6Ly93d3cuZ2Vv
   dHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5MA0GCSqGSIb3DQEBBQUAA4GB
   AHbhEm5OSxYShjAGsoEIz/AIx8dxfmbuwu3UOx//8PDITtZDOLC5MH0Y0FWDomrL
   NhGc6Ehmo21/uBPUR/6LWlxz/K7ZGzIZOKuXNBSqltLroxwUCEm2u+WR74M26x1W
   b8ravHNjkOR/ez4iyz0H7V84dJzjA1BOoa+Y7mHyhD8S
   -----END CERTIFICATE-----  
   

   
   

   Subject: C=US, O=GeoTrust, Inc., CN=GeoTrust SSL CA

   
   
   

   -----BEGIN CERTIFICATE-----
   MIID2TCCAsGgAwIBAgIDAjbQMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT
   MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i
   YWwgQ0EwHhcNMTAwMjE5MjIzOTI2WhcNMjAwMjE4MjIzOTI2WjBAMQswCQYDVQQG
   EwJVUzEXMBUGA1UEChMOR2VvVHJ1c3QsIEluYy4xGDAWBgNVBAMTD0dlb1RydXN0
   IFNTTCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJCzgMHk5Uat
   cGA9uuUU3Z6KXot1WubKbUGlI+g5hSZ6p1V3mkihkn46HhrxJ6ujTDnMyz1Hr4Gu
   FmpcN+9FQf37mpc8oEOdxt8XIdGKolbCA0mEEoE+yQpUYGa5jFTk+eb5lPHgX3UR
   8im55IaisYmtph6DKWOy8FQchQt65+EuDa+kvc3nsVrXjAVaDktzKIt1XTTYdwvh
   dGLicTBi2LyKBeUxY0pUiWozeKdOVSQdl+8a5BLGDzAYtDRN4dgjOyFbLTAZJQ50
   96QhS6CkIMlszZhWwPKoXz4mdaAN+DaIiixafWcwqQ/RmXAueOFRJq9VeiS+jDkN
   d53eAsMMvR8CAwEAAaOB2TCB1jAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFEJ5
   VBthzVUrPmPVPEhX9Z/7Rc5KMB8GA1UdIwQYMBaAFMB6mGiNifurBWQMEX2qfWW4
   ysxOMBIGA1UdEwEB/wQIMAYBAf8CAQAwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDov
   L2NybC5nZW90cnVzdC5jb20vY3Jscy9ndGdsb2JhbC5jcmwwNAYIKwYBBQUHAQEE
   KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5nZW90cnVzdC5jb20wDQYJKoZI
   hvcNAQEFBQADggEBANTvU4ToGr2hiwTAqfVfoRB4RV2yV2pOJMtlTjGXkZrUJPji
   J2ZwMZzBYlQG55cdOprApClICq8kx6jEmlTBfEx4TCtoLF0XplR4TEbigMMfOHES
   0tdT41SFULgCy+5jOvhWiU1Vuy7AyBh3hjELC3DwfjWDpCoTZFZnNF0WX3OsewYk
   2k9QbSqr0E1TQcKOu3EDSSmGGM8hQkx0YlEVxW+o78Qn5Rsz3VqI138S0adhJR/V
   4NwdzxoQ2KDLX4z6DOW/cf/lXUQdpj6HR/oaToODEj+IZpWYeZqF6wJHzSXj8gYE
   TpnKXKBuervdo5AaRTPvvz7SBMS24CqFZUE+ENQ=
   -----END CERTIFICATE-----
   

   
   

   It is not necessary to install these certificates.

3. New certificate, valid from 23 March 2011:
   
   

   -----BEGIN CERTIFICATE-----
   MIIEhjCCA26gAwIBAgICfEYwDQYJKoZIhvcNAQEFBQAwQDELMAkGA1UEBhMCVVMx
   FzAVBgNVBAoTDkdlb1RydXN0LCBJbmMuMRgwFgYDVQQDEw9HZW9UcnVzdCBTU0wg
   Q0EwHhcNMTEwMzIzMjEyMzQ1WhcNMTYwNjEyMjM0ODI3WjCBozEpMCcGA1UEBRMg
   YWNnU1dOYTZBVy9KZ2JaZUFKcW9rV0VwenlORDlscUIxCzAJBgNVBAYTAkRFMR0w
   GwYDVQQIExRSaGluZWxhbmQtUGFsYXRpbmF0ZTEOMAwGA1UEBxMFTWFpbnoxHTAb
   BgNVBAoTFElCTSBEZXV0c2NobGFuZCBHbWJIMRswGQYDVQQDExJmdHAuZWN1cmVw
   LmlibS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7fmw1g5xB
   YY1fXqZbSb1GrS7B1yfGkJulbxQFW+i1sbgfgcMGgopAJrWUc4Zat0CXFbC9vuQz
   lWEuzSeDkaIcJ7YlM+8RhHGiMK0gma2JGnnXBXHgAM7g1mjmQRzmJI5u+JlzKIfn
   dFhHtOcCIAIHU8equgaENDOFgkNMQHD8w4mxd1SAlf2nyf2v/YQu+SZWCmJRLg/D
   K2loHRIyXECfdkMui4ooZeD2x1ZMlD+GDxKG075OQwTd52UDxRNQi2bO0Ko5Ctmu
   oIXAgpcsEIsnOvDzBnARa7I5bGOUlfGG89SZ/LLHDngVuREtwGwkSA7c55Qnd0Qm
   UmyC991IqFcNAgMBAAGjggEkMIIBIDAfBgNVHSMEGDAWgBRCeVQbYc1VKz5j1TxI
   V/Wf+0XOSjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG
   AQUFBwMCMB0GA1UdEQQWMBSCEmZ0cC5lY3VyZXAuaWJtLmNvbTA9BgNVHR8ENjA0
   MDKgMKAuhixodHRwOi8vZ3Rzc2wtY3JsLmdlb3RydXN0LmNvbS9jcmxzL2d0c3Ns
   LmNybDAdBgNVHQ4EFgQUm4EpB+2i3mJsN9H5TiiaNPWNW6IwDAYDVR0TAQH/BAIw
   ADBDBggrBgEFBQcBAQQ3MDUwMwYIKwYBBQUHMAKGJ2h0dHA6Ly9ndHNzbC1haWEu
   Z2VvdHJ1c3QuY29tL2d0c3NsLmNydDANBgkqhkiG9w0BAQUFAAOCAQEARM4k2WiY
   UbfYAUrJ9aWBGZxj8P32LexvWcekUv2SRp9bDs0BJxvavMfmhH3PSUav4b4EpzPD
   /ue4ph5ZfBjqsCLhg4c3Qi518Rw+plYsDz+weA7jdpIA0I/JiMGtw5RmHxWRX8MN
   ivZ0OXHEsFZ4sHK38VC2sD7+zueBraxWdqYraUp9C3h5EmRD536JfVWCegYhEg8H
   9VufdrWTZHGNdEO7wMv0b3XlSEpAKnyCFENHk9Pb3/UlEur0DpDAOYBWgRW5V334
   qSi2rAqTN4nUgYfTm8yBBf5DuwH/JCO+cy8Q5+ndiMTrAv6K/Rj7cDOpfjD5HqpX
   RBIkl2YOm/eURQ==
   -----END CERTIFICATE-----
   

   
   

   Use Copy and Paste to place this Certificate into a second SEQUENTIAL, VARIABLE BLOCKED dataset, be sure to include the top and bottom dashed lines. Name this dataset 'SYS1.FTPEMEA.CERT'.

   Do NOT change the content!

4. Add the GeoTrust Trusted Root Certificate to your RACF database as a CERTAUTH Certificate. Use the RACF dialogs as follows:
   • From the RACF Primary Panel (ICHP00), select Option 7 - DIGITAL CERTIFICATES AND KEY RINGS
   • On the next panel (ICHPB70), select Option 4 - Add, Alter, Delete, or List certificates.....
   • On the next panel (ICHPB0), select Option 1 - Add a digital certificate to the RACF database and enter any character under the Certificate Authority-heading in the next line, then press ENTER
   • On the next panel (ICHPB01A), you will now notice the highlighted word CERTAUTH.
   • Enter the Data Set Name (in quotes) 'SYS1.CA.CERT' in the first input field.
   • Enter the Label Name (in quotes) in the next input field. The label name must be specified as : 'Equifax Secure Certificate Autho'. Caution, this field is case-sensitive.
   • In the Field Status Trust enter the character H for Hightrust, then press ENTER.

   Alternatively, you can issue the RACF command:

   RACDCERT CERTAUTH -
ADD('SYS1.CA.CERT') -
HIGHTRUST -
WITHLABEL('Equifax Secure Certificate Autho')


5. Add the ECuRep FTP Server Certificate to your RACF database as a SITE Certificate. Use the RACF dialogs as follows:
   • From the RACF Primary Panel (ICHP00), select Option 7 - DIGITAL CERTIFICATES AND KEY RINGS
   • On the next panel (ICHPB70), select Option 4 - Add, Alter, Delete, or List certificates.....
   • On the next panel (ICHPB0), select Option 1 - Add a digital certificate to the RACF databaseand enter any character under the Site-heading in the next line, then press ENTER
   • On the next panel (ICHPB01A), you will now notice the highlighted word SITE.
   • Enter the Data Set Name (in quotes) 'SYS1.FTPEMEA.CERT' in the first input field.
   • Enter the Label Name (in quotes) in the next input field. The label name must be specified as : 'ftp.ecurep.ibm.com'. Caution, this field is case-sensitive.
   • In the Field Status Trust enter the character T for Trust, then press ENTER.

   Alternatively, you can issue the RACF command:

   RACDCERT SITE -
ADD('SYS1.FTPEMEA.CERT') -
TRUST -
WITHLABEL('ftp.ecurep.ibm.com')


6. Create a RACF KEYRING for EACH userid(!) who would like to use Secure FTP. Use the RACF dialogs as follows:
   • From the RACF Primary Panel (ICHP00), select Option 7 - DIGITAL CERTIFICATES AND KEY RINGS
   • On the next panel (ICHPB70), select Option 6 - Create, List, or Delete an entire key ring....
   • On the next panel (ICHP75), select Option 1 - Create a new key ring and enter the userid for which you create this keyring.
   • On the next panel (ICHP75A), enter a name for the keyring (WITHOUT quotes), e.g. SECURE.FTP.KEYRING

   Alternatively, you can issue the RACF command:

   RACDCERT ID(userid) ADDRING(SECURE.FTP.KEYRING)


7. Connect the CA certificate to each user's(!) keyring. Use the RACF dialogs as follows:
   • From the RACF Primary Panel (ICHP00), select Option 7 - DIGITAL CERTIFICATES AND KEY RINGS
   • On the next panel (ICHPB70), select Option 6 - Create, List, or Delete an entire key ring....
   • On the next panel (ICHP75), select Option 4 - Connect a digital certificate to a key ring and enter the userid to whose keyring you connect this certificate.
   • On the next panel (ICHP754), enter the keyring name, e.g. SECURE.FTP.KEYRING. In the fields Certificate Type and Usage, enter any character under Certificate Authority and enter the Label Name (in quotes) 'Equifax Secure Certificate Autho', then press ENTER. (The field Default defaults to NO, that's fine)

   Alternatively, you can issue the RACF command:

   RACDCERT ID(userid) -
CONNECT( -
CERTAUTH -
LABEL('Equifax Secure Certificate Autho') -
RING(SECURE.FTP.KEYRING) -
USAGE(CERTAUTH) -
)


8. Connect the ECuRep FTP Server Certificate to each user's(!) keyring. Use the RACF dialogs as follows:
   • From the RACF Primary Panel (ICHP00), select Option 7 - DIGITAL CERTIFICATES AND KEY RINGS
   • On the next panel (ICHPB70), select Option 6 - Create, List, or Delete an entire key ring....
   • On the next panel (ICHP75), select Option 4 - Connect a digital certificate to a key ring and enter the userid to whose keyring you connect this certificate.
   • On the next panel (ICHP754), enter the keyring name, e.g. SECURE.FTP.KEYRING. In the fields Certificate Type and Usage, enter any character under Site and enter the Label Name (in quotes) 'ftp.ecurep.ibm.com', then press ENTER. (The field Default defaults to NO, that's fine)

   Alternatively, you can issue the RACF command:

   RACDCERT ID(userid) -
CONNECT( -
SITE -
LABEL('ftp.ecurep.ibm.com') -
RING(SECURE.FTP.KEYRING) -
USAGE(SITE) -
)


9. Do a RACF Refresh of the (hopefully) RACLISTed classes DIGTCERT and DIGTRING. Issue the RACF command:

   SETROPTS RACLIST(DIGTCERT DIGTRING) REFRESH


10. That's it! However, please remember that each userid now has his/her own keyring. In the TCP/IP parameters for your FTP CLIENT, you can just enter ONE keyring. That implies that you will have to create a separate FTPDATA dataset/member/file for EVERY userid who wants to exploit Secure FTP.

If you cannot see the AUTH TLS command, you can check the status of the session with a remote stat command. The highlighted lines indicate a secure session.