Re: Inbound SSH allowed to be used with Code for i and other tools ?

[Richard Schoen <richard@xxxxxxxxxxxxxxxxx>]

Thanks Rob.

Good insights. 

FYI - I started a github page with various SSH links.  If anyone has one to contribute send my way. 
https://github.com/richardschoen/howtostuff/blob/master/ibmisecuresshsetup.md


Regards,
Richard Schoen
Web: http://www.richardschoen.net
Email: richard@xxxxxxxxxxxxxxxxx
 
------------------------------

message: 2
date: Wed, 30 Oct 2024 15:07:09 -0400
from: Rob Berendt <robertowenberendt@xxxxxxxxx>
subject: Re: Inbound SSH allowed to be used with Code for i and other
	tools ?

Often these are recommendations.  And, if you have a written business case as to why you need SSH connection you can get it.
Here, we have a tool which monitors many of the stuff you can install on your PC.  If you try to install putty you have to write something up and they contact the tool vendor and get you excepted.  Do not believe you can just download putty yourself, install it and go.  I've tried, when I got my new laptop.  It stops it dead.  I explained I needed it for HMC communicating, etc.  And I immediately asked and got permission.

Summary:  So, apparently it is not uncommon to find sites like this.  Most times it can be overridden if you just can get over the fear of asking and communicating.

To the best of my knowledge, the main concern with SSH is that it is the open system version of secure telnet and the preferred tool of those who like command line access to many pieces of equipment versus the GUI interface.  And is quite easy to script and be used to probe for openings.

On Wed, Oct 30, 2024 at 2:51?PM Richard Schoen <richard@xxxxxxxxxxxxxxxxx>
wrote:

> Using SSH with IBM i.
>
> How many of you work in businesses where you're allowing SSH to be 
> used with tools like VS Code ?
>
> I'm hearing varying opinions because of potential security issues.
>
> Was talking to a large insurance company yesterday and they asked best 
> way to secure SSH. Currently they don't allow it so RDI only tool 
> option for editing.
>
> Also if allowing SSH, what's a good way to monitor SSH connections and 
> connection attempts ? (I know I've seen SSH be used for DOS attacks 
> before on public IBMi systems.)
>
> Would be interesting to see Mapepire and/or codefori server morphed 
> into an appropriate server that wouldn't require an SSH connect.
>
> I've done connectivity via jt400 in Java and .Net for years before we 
> had SSH.
>
> I would love to hear your opinions as the hesitation because of system 
> compromise is real.
>
> Regards,
> Richard Schoen
> Web: http://www.richardschoen.net<http://www.richardschoen.net/>
> Email: richard@xxxxxxxxxxxxxxxxx<mailto:richard@xxxxxxxxxxxxxxxxx>