Re: Secure Shell on the 400

[Scott Klement <klemscot@xxxxxxxxxxxx>]

On Wed, 14 Nov 2001, James Rich wrote:
>
> > So I can't turn off telnet into the BSD box until
> > the AS/400 supports an SSH client... that's where I was going with this.
>
> Does this software actually talk to the telnet daemon?  Does the
> expect-like stuff run on the AS/400 or FreeBSD?  Are you trying to do an
> rexec or rsh type of thing (not that rsh is in any way secure)?  You've
> piqued my interest here...
>

The particular software that I'm referring to runs on the AS/400.  It
is actually just a proxy, it connects to the telnet daemon on the
BSD box as well as allowing the AS/400's telnet client to connect
to it.  It then acts like an expect script to type commands in
for the user -- that way a non-technical user can type a menu option on
the AS/400, and it'll log into the BSD box and do things without them
needing to understand how to do them.

a few things I use it for:

   1) Saving data to floppy.  The AS/400 program makes a SAVF, FTPs it
        to the BSD box, then uses the expect-like program to to log
        on to the BSD box and save it to floppy, spanning floppies
        where needed.  (Also can restore the same stuff...)

   2) Talking to our bank.  We dial in, navigate the bank's menus and
        then use XModem to send/receive direct deposit and check
        reconciliation info.   Rather than buy software for the AS/400,
        it was easier to use the open-source software that already exists
        for FreeBSD.   This also saved us having to buy seperate modems
        for the BSD box and the '400

   3) Err... I know I use this for some other things, but I can't think
        of them off the top of my head.

At any rate, this method works well because the user doesn't need to know
what to type, it types it for them.   But, on the other hand, they can see
exactly what's going on, so if something unexpected occurs it's visible on
the screen and the person running the option can apply intelligence to the
situation.  (Which usually means calling me.. heh)

I'd love to convert this to SSH to eliminate the need for running the
telnet daemon.   But -- for the time being telnet is pretty safe, since
I have it firewalled off from outside the LAN...