RE: Setting Up sFTP for a Second Vendor - Host key

A much simpler way to verify the remote host is with ssh-keyscan:

ssh-keyscan remotesys >> ~user2/.ssh/known_hosts

(Technically, if you want to be really secure you would have them send you
the expected fingerprints and add them manually, since someone could
man-in-the-middle you here, but this is no less secure than replying "yes"
to the question it asks on first connection)


> Is my IBMi asking for a password or is the vendor's system asking for a
password?

It's asking for the password to the remote system. If the server is
successfully configured to accept that your private key, then you are not
yet configured properly.


The permissions on the client are not as picky as they would be on the
server. If your client keys were too open, you'd be getting a giant
warning like:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0666 for '/home/kadler/.ssh/id_rsa' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "/home/kadler/.ssh/id_rsa": bad permissions


Make sure that you are finding the keys correctly. When you call
sftp/ssh/scp it will look for default key files (id_rsa, id_ecdsa,
id_ed25519, etc) under ~/.ssh. It does not matter what user you are trying
to connect as, only the user who is running sftp. So if you are logged in
as JOEUSER and run sftp remotesys it will look for
/home/JOEUSER/.ssh/id_rsa and if you are still logged in as JOEUSER and
run sftp saralee@remotesys, it will still look for
/home/JOEUSER/.ssh/id_rsa. If you want to use the
/home/SARALEE/.ssh/id_rsa file to log in, you must be running under the
SARALEE user profile OR you can explicitly specify the path with the -i
option: sftp -i /home/SARALEE/.ssh/id_rsa saralee@remotesys.

If you want to ensure that you only use your public key to authenticate,
you can disable the other options in the ~/.ssh/config or on the command
line:

sftp -oChallengeResponseAuthentication=no
-oKbdInteractiveAuthentication=no -oPasswordAuthentication=no
-oPubkeyAuthentication=yes remotesys

> He thinks at this point I should be able to sftp to his system and get
his public key and load it on my system.

Why would you need to load his public key on your system? Is he going to
be logging in to your system?


One thing to note about permissions: by default the root directory has the
sticky bit set, which gets propagated all the way up as you make a new
directory and does not get unset when you run chmod unless you specify a
4-digit mode: chmod 0755. Note, however that QSH chmod does not accept
4-digit modes, so you have to do it in QP2TERM/SSH or call
/QOpenSys/usr/bin/chmod from QSH.