SFTP Service (ORK-TR)

Size: px

Start display at page:

Download "SFTP Service (ORK-TR)"

Isabel Hart
6 years ago
Views:

1 SFTP Service (ORK-TR) Version 1.3 BME

2 VERSION CONTROL TABLE Version Date Changes / Modifications Author /10/2017 N/A Ignacio Herrero /10/2017 Corrections Ignacio Herrero /10/2017 Addition Annex SFTP keys generation Fernando Parra /11/2017 Adding screen captures amendments about downloading and installing WinSCP version for allowing the connection with a SFTP server. Page 23 Annex II. Fernando Parra SFTP SERVICE (ORK TR) Page 2 of 37

3 Nondisclosure This document contains information that must be confidentially stored and handled. Any reproduction, distribution, communication, transformation in whole or in part, free or onerous, by any means or processes, without the prior written permission of BME, is strictly forbidden. This document is strictly confidential. If you decided not to accept this project with BME, all copies of this document, together with the written confirmation of not having retained any copies of the document or its contents should be returned at our request. Personal data protection Although there is no treatment of personal data expected, in the event that BME would carry out any management of the personal data acknowledged as a result of this document, it would be carried out in accordance with the requirements of the Organic Law 15/1999, of December 13, for the Protection of Personal Data. SFTP SERVICE (ORK TR) Page 3 of 37

4 Index 1. INTRODUCTION MEMBER S FOLDERS WRITING AND READING RULES WRITING READING NOMENCLATURE INPUT OUTPUT CNMV FILE S NOMENCLATURE IN SFTP (ONLY FOR TR) CNMV FILES MAINTENANCE FILE CRYPTING CRYPTED FILES FOR BME CRYPTED FILES FOR MEMBERS AND ENTITIES SFTP CONNECTION PARAMETERS TRAINING PRODUCTION CONNECTIVITY FORM ANNEX ANNEX I: BASIC GPG COMMANDS How to create public/private keys How to export a public key How to import a public key How to encrypt a file How to decrypt files SFTP SERVICE (ORK TR) Page 4 of 37

5 10.2. ANNEX II: CLIENT SFTP USE EXAMPLE Downloading and installing WinSCP Spftware Download software Installation Configuration of the SFTP connection Public / Private key generation Public key generation Private key generation Authentication settings for the SFTP connection SFTP server connection SFTP SERVICE (ORK TR) Page 5 of 37

6 1. INTRODUCTION The present document provides a detailed description of the performance of the SFTP for the service STR, which we provide in BME. This service allows and provides the exchange of files through SFTP for the ORK and the RT, as well as the specific information considering every step of the process. 2. MEMBER S FOLDERS Each member will have a structure of folders exactly like in the example: As it can be observed from the screen shot above, each member will see inside his own SFTP folder, two subfolders, filesin and filesout. Inside the filesin folder, the members will upload the desired files they wish to send to BME, ORK and RT, since these are distinguished by the nomenclature. Inside the filesout folder, the members will receive the ORK and RT files sent from BME, since these are distinguished by the nomenclature. SFTP SERVICE (ORK TR) Page 6 of 37

7 3. WRITING AND READING RULES 3.1. WRITING The files must be written with the prefix TMP_ followed by the file name. Once the file has been written completely in the SFTP server, the file must be renamed, removing the prefix TMP_. The final nomenclature of the file is described in section 4 of this document. Example: Filename: INB_LEI1_LEI2_TIPO_AAAAMMDD_SEQ.EXT During the process of upload the file should be named TMP_ INB_LEI1_LEI2_TIPO_AAAAMMDD_SEQ.EXT Once the file is uploaded, it will be renamed with its definitive name: INB_LEI1_LEI2_TIPO_AAAAMMDD_SEQ.EXT 3.2. READING Only files beginning with OUT or INB should be collected, but never those starting with the prefix "TMP_", since the presence of this prefix indicates that the file is being written at that precise moment, and therefore, the file is not complete. 4. NOMENCLATURE The right nomenclature depends on if we are talking about an input file or an output file. The nomenclature which must be followed by the files will be the next one: 4.1. INPUT INB_LEI1_LEI2_TIPO_AAAAMMDD_SEQ.EXT_MD5 INB(3) INBOUND. Indicates an input file LEI1(20) LEI code of the member who is sending the file. LEI2(20) LEI code of the member by whom the file is being send. It can be the same as LEI1 if it matches TIPO(1 a 4) File type AAAAMMDD(8) File s creation date. SEQ(3) 3 digits sequency. Example: 001 SFTP SERVICE (ORK TR) Page 7 of 37

8 EXT(3) File extension. MD5(33) The md5 hash of the file will be included after the extension so that it can be validated that the file is the same in origin and destination. This hash is used to verify that the file has not undergone any modification, once received the file and checked, the hash can be removed so that the file remains with its correct extension OUTPUT OUT_LEI1_LEI2_TIPO_AAAAMMDD_SEQ.EXT_MD5 OUT(3) OUTBOUND. Indicates an output file LEI1(20) LEI code of the member who receives the sending. LEI2(20) LEI code of the member in the name of who we are making the sending. It can be the same that the LEI1 if both of them are matching. TIPO(4) File type AAAAMMDD(8) File s creation date. SEQ(3) 3 digits sequency. Example: 001 EXT(3) File extension. MD5(33) The md5 hash of the file will be included after the extension so that it can be validated that the file is the same in origin and destination. This hash is used to verify that the file has not undergone any modification, once received the file and checked, the hash can be removed so that the file remains with its correct extension. SFTP SERVICE (ORK TR) Page 8 of 37

9 5. CNMV FILE S NOMENCLATURE IN SFTP (ONLY FOR TR) 5.1. CNMV FILES Original file: SubmEnt_ExecEnt_FileType_Sequence-Version_Year.XML SFTP OUTPUT File : OUT_Lei1_SubmEnt_ExecEnt_FileType_Sequence-Version_Year.XML Renamed file to Lei1 folder: OUT_Lei1_SubmEnt_ExecEnt_FileType_Sequence-Version_Year.XML SubmEnt_ExecEnt_FileType_Sequence-Version_Year.XML SubmEnt (20 characters): This is the valid LEI code for the Entity sending the file, according to the technical instructions for reporting defined by CNMV, in this case, the LEI code for BME Regulatory Services. ExecEnt (20 characters): This is the valid LEI code for the Entity who executes the operations, according to the technical instructions for reporting defined by CNMV. FileType (3 characters): File type, the possible values will be TRA o REQ. Sequence: It is the numerical sequence of 6 positions filled with zeros from the left hand and beginning with "000001", at the level of each sent file by the sending Entity (SubmEnt) and file processed in the CNMV. Version: It is the numerical sequence of 2 positions filled with zeros from the left hand and starting with "00", which will be increased for the same file (SubmEnt + Sequence) if the file is rejected by file-level error by the CNMV. Year: It corresponds with the last 2 digits of the year which the file was sent. LEI1(20) LEI code of the member who receives the sending OUT(3) OUTBOUND. Indicates it is an output file. SFTP SERVICE (ORK TR) Page 9 of 37

10 6. MAINTENANCE The folder will include a Maintenance rule, to assure that if after 15, the clients have not downloaded the files, these ones will be deleted for the SFTP cages. 7. FILE CRYPTING The encrypted files must keep their original name. It is mandatory to include the.gpg extension, in order to clarify the name of the file that must be decrypted. Example: File OUT_LEI1_LEI2_TIPO_AAAAMMDD_SEQ.EXT_MD5 Crypted file: OUT_LEI1_LEI2_TIPO_AAAAMMDD_SEQ.EXT_MD5.gpg Once it is encrypted, the file: OUT_LEI1_LEI2_TIPO_AAAAMMDD_SEQ.EXT_MD5 must be named OUT_LEI1_LEI2_TIPO_AAAAMMDD_SEQ.EXT_MD5.gpg 7.1. CRYPTED FILES FOR BME In order to submit encrypted files to BME, files must be encrypted with the GPG public keys of BME. BME hast two Public keys, one for each environment. Test: Training: form_encrypt.asc -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1 mqenbfhiw+abcacbau4o80hsj3d1wdutrxueqh86w9bsdcvlxj8du8oayhemrn49 jd7t/jidiesuzwxhw2oaqgheyzihknrqas+qhfvg9advtcjvgjpp21blkfreqafw qxmohsj0qs65cmghby/5oylsyzklugejkgnbsw0cnwndfgz6iwza01rzv96sqbb3 8wkWzJ69u4tlatn6qi3wqZIFgMlXAoD6yLXVLQ853k8f8L2DtEwKqYLEQ6wRu9tl 4dxKaJ976W7pvnHb8oxZrLZuWnZX6cNlJJeDVq0jvprYqGMY20GxWRU+0RIn4/6P w3t6f9f7m4vaadxj+qhevsqaczzqgsqnomy5abebaag0oujnrsbgb3jtievuy3j5 chrpb24gs2v5ichgb3jtksa8zm9ybv9lbmnyexb0qgdydxbvym1llmvzpokboaqt AQIAIgUCWGJb4AIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQ9bJsuU99 qygzeaf+nr+zwocn1fe+jh9glksmotyujzwj+g/syzdbus5lk6hvnjgrtoolchzv m9cwnqcknljixjaidui14ypjfdb68u3p+klzixu4rqb2ucplxuxro1i9zsooeldq GSkArK0fFI3JOkGgZ8jEY1+KqlPUw+l3VmQxGjL4Xwb2SyJ9Y5/OSa+IiNYD+PAU EkVwYzADM3sLPe2kLL1/7mKpLVCouCmFLWJ2vX8j/W+U16EpA/Nl6vOKrx9hTnYy 8xsJiLhgB0kINhv3/F5qmZZhSWpSqEe9nbMsi4KhXna3WVcqKkH+rjbLuomfmPAS KQCfcVPEom58lJ0XKfsyLEanxn3V9LkBDQRYYlvgAQgA0pZg+uvCBXRBzDuZWyeG q6dy0jq9okpusvub4wagfvhmxmvjjai0/7au4sc0iftco6e0f8cykswxhfqq0vie SFTP SERVICE (ORK TR) Page 10 of 37

11 mqlghhdk9jdeiy6t0esw5wxm9o1g/j8ytnh6ukbq/sv8qb2wgfovowru/k/vwru/ SwdBsBXKD5L1NQFSzhrDoUn2pbu3B7tCydKR+dDc9mm8780EJiX/cM8kB381rVmq LyfwhiHNPtmwAh0TsKRAvpXGpUQIF5kWky64Sp3OtpmcqY8CSKhGQICB8wY2UEiI O06ufE78NWzN19W+5Wmbgphlz3clz8HOoZzdmEAjelPKzkRJnxyPDwDP0Rh74LR2 7QARAQABiQEfBBgBAgAJBQJYYlvgAhsMAAoJEPWybLlPfamIREoH/3c7BnyUpZLV mok8lxzrpuyhtn7frj4avzqzl9aj538+la9sjk7f+dsosqvdy76g2kw6ksg5m5yh Ruc7y9FGBoY1hOvOLNx7I5DG2SyGjSKZcq3lJs5qPZ3N7WOF4wLOEHO3qh83tGda RP610zZQcYdxvxUNswsAh/5VZojqcxb9gERXhFfNvm94yuZ3YsZX+M/u5OXHhGmV IROOrLC7jTI4B/GatP+bxuFWNBOs+falrxQVfawiUYKZ0Cp1sgJH4Og2XRU/iabo 4tUJMKw3xOd6aTXip7EpNZDJKrUidUK8eA9jPJbmn+XwYNHO4FpMeXzgwJUbzaR1 /wcxukhag68= =Z1Sd -----END PGP PUBLIC KEY BLOCK----- Production: prod_encrypt.asc -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1 mqenbfhiw64bcadodngkv+kedwamhxtsfmjcqt28oen7wcyhuhmwvfvoo9b1vlqh ZmCyANC7e0TnPnDsOf/6sBckZNGz5O4SWG1UsRb3nxD4oArvc9jjwYF/9maejUA+ 6S5HEupT+R8cpjcB9INvp92zn3muMXwsyAPaMiAwrS4FXZ3PYxZrGCNmmBL/eOJ/ vekmirpdu2gtxjs5a0tdx0n0twcc2lqkb/qgfa7mshmzh1tcpy1g2ta01wcp1fih NNd7wTTntGYpUTVDgunTi54tU5DasRqfdjUeCiWNqC4BwjE7IRnVNcWMMA/3alCL XvwMguE6tqQ+oj8l0xwR1s7WS8mpuHNwKW59ABEBAAG0OUJNRSBFbmNyeXB0aW9u IEtleSAoUHJvZHVjdGlvbiBLZXkpIDxlbmNyeXB0QGdydXBvYm1lLmVzPokBOAQT AQIAIgUCWGJbrgIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQeAOy8oqz djhxcagag6p0os2bwkurolssgn/axovxecezuz8cwkluooybf0yxsfcdup0x7bsl QQwSheC/RflFe5SU2uJSPUIQqbzih8lm7OrMmXapsO1ETlV0uFw157cv09Tg0g96 kpssl+d9/e3x9lz0pefwkuupne7eboso+olafe/q0mujhr6golxv1pured9c/1im HGMS1TP2TQyknAGyWpdzRZ90eSj3RamQ/Hpo9j4nG7F3Kxw3hodzYe17i9+BUDB0 /4Gm+Yurwidl7QE71ASRe6V80jWQWlBcQo7+/GzgFzzou22fvbeWQkR0UraM3IX4 mmeaqubt2hslwtxcnwgxs/alyddk57kbdqryyluuaqga0lr2b+m6hsulwhpcewcd AkhpfzrtY+JBmYXZxv2e7uL4Uvn68U2OES20QbOEyUDYy9R68zYA/Q4QEkCTn0Ow jnetp4cjqtjezusyirafhz8lxv7nhz3x2ybomjta6bkrnrahc486jshhqbfqs3ps 6E6UIEI7KgOkEBBJjAoj/D4JzWAxoxrU1Zoxb/VxFUVCi/BMIA0YXxPD/VHlzGrt hss+lmefioyh/mw9xsbynahrfxqyuizzl4x185qlb5wy2j3equdqo6o8smo5j3uq c5hxfr8mezt3vsb1w0mlfamhd0hvdbrywmeysuehrvpilhvomkkddkb+uewnlk0k iwaraqabiqefbbgbagajbqjyyluuahsmaaojehgdsvkks3y4rqih/1e4tdimj+/i FPK6gW1bJHipjs7Dlf+fzJYfnAEYBKunb66/fupm9i0bHLlnyuTnJjijosJ/shRb j4gfkw+2ovimsaitfh3zpov4ukjcgjeov/wu47xiyz9xar/guhlrumzqehxy9+cb a7pjzc6dowlyznfityqghwurccz4mohikhdizrrl3+iiorc17f68tlh5/a+tffin 1sUWNa/GO7KmL9DXlh82ZhqQhKcYsvURzq+jHxck8/cWgOWCntWiPVMXFtTrk+ml chaj0ltjzswiowji56x1g0wvte36typev3bdfjcldfc4x6ez0q4nekanufmsuagh HI7fdcmn9+mZAQ0EWGJb4AEIAJtpTg7zSFKPd3VZ1S2vFR6qHzpb0GwMJWVePx1T w5ricqxe3j2n3u38kgoj6xrnbefby4bccerhmkgsetbpl6ocvub0b1w1ynuaomnb VsuQWsRBp9arEygdInRCzrlyaAdvL/k7ItLLMqW6B4mQY0GxbRw3Cd0WBnqLBlrT Wtm/3pKptvfzCRbMnr27i2Vq2fqqLfCpkgWAyVcCgPrItdUtDzneTx/wvYO0TAqp gsrdrbg722xh3epon3vpbum+cdvyjfmstm5adlfpw2ukl4nwrso+mtioyxjbqbfz FT7REifj/o/De3p/1/ubi9pp3En5Ad69KppxlmqCyo06ZjkAEQEAAbQ5Qk1FIEZv cm0grw5jcnlwdglvbiblzxkgkezvcm0pidxmb3jtx2vuy3j5chraz3j1cg9ibwuu ZXM+iQE4BBMBAgAiBQJYYlvgAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAK CRD1smy5T32piBl4B/42v7NY5yfUV76Mf2CWSwyi1hQllaP6D+xjMMG6zmWTodWc mctm46vwfo+b0jaeoiqcsmlekcio4jxjkmmv0hry7c/6qtmlftitbva5ymvdtfe7 WL3NKigSV2oZKQCsrR8Ujck6QaBnyMRjX4qqU9TD6XdWZDEaMvhfBvZLIn1jn85J r4ii1gp48bqsrxbjmamzews97aqsvx/uyqktuki4kyutyna9fyp9b5txoskd82xq 84qvH2FOdjLzGwmIuGAHSQg2G/f8XmqZlmFJalKoR72dsyyLgqFedrdZVyoqQf6u Nsu6iZ+Y8BIpAJ9xU8SibnyUnRcp+zIsRqfGfdX0uQENBFhiW+ABCADSlmD668IF dehmo5lbj4aronjqmr2gqlrjw5vhzqavuczexwmkajt/tq7ixzsiw0kjotqxwjgp SFTP SERVICE (ORK TR) Page 11 of 37

12 JbEcWpDRWJ6aouAeF0r0kN6LLpPQRJbnBcz2jWD+PzK00fpQoGr+y/yoHbCB+hWh ZG78r9XCu79LB0GwFcoPkvU1AVLOGsOhSfalu7cHu0LJ0pH50Nz2abzvzQQmJf9w zyqhfzwtwaovj/cgic0+2bachrowpec+lcalragxmratlrhknc62mzypjwjiqeza gihzbjzqsig7tq58tvw1bm3x1b7lazucmgxpdyxpwc6hnn2yqcn6u8roremfhi8p AM/RGHvgtHbtABEBAAGJAR8EGAECAAkFAlhiW+ACGwwACgkQ9bJsuU99qYhESgf/ dzsgfjslktwy4ryxfle9rgdm3t+snhpvlbkv1onnfz6ud1ikrsx52yiypv1jvoby pbopibmblifg5zvl0uyghjwe684s3hsjkmbzlianiplyreumzmo9nc3ty4xjas4q c7eqhze0z1pe/rxtnlbxh3g/fq2zcwch/lvmiopzfv2arfeev82+b3jk5ndixlf4 z+7k5ceeazuhe46sslunmjgh8zq0/5vg4vy0e6z59qwvfbv9rcjrgpnqknwyakfg 6DZdFT+Jpuji1QkwrDfE53ppNeKnsSk1kMkqtSJ1Qrx4D2M8luaf5fBg0c7gWkx5 fodalrvnphx/alfqqecdr5kbdqryylv+aqgarbu4t0nbyrm7urad6l7eexndbjan man0hjmcnr9ptvqjpgbyyw4ouzg787g1sdbwiffr3wpu6rx/+dlsmtym0mwnjn4u tjcr+yonqvab6kwfvgfol4ou1hprpvsfd9kyzc+ecxuwiioaui2yrsgm+zee21nw xssjlbw70bn3nwbg73mms5l1l8nqaf4rsmtrzpwsp0xwt4pei2z8nat3/zc6viuu ZF7AaMAauLRJg7jpYAoO/mlj/MvflGFqqFfu0gqiGkp8ufA4iuM8qK/TqqAoFULL 5X4Ve/WENqMGP//3zXAE4sDze1zejC+QPi6jajARVNPA4ALI54gUkMBaZwARAQAB tdlctuugvgvzdcbfbmnyexb0aw9uietlesaovgvzdckgphrlc3rfzw5jcnlwdebn cnvwb2jtzs5lcz6jatgeewecacifalhiw/4cgwmgcwkibwmcbhuiagkkcwqwagmb Ah4BAheAAAoJEMcEF1rRuWG/+dQH/2b1mo+2cTOcDFn2ApPhcLXX63bMYRlvDGUV YL8/NOG0RTeFl+7J0iyOk854XDArH5h7sd1osVWYVhciZu0x7XgEcApXjYJgjCtK QjahuJ1TXfHcTuZyEUtJo3e13ipnB9XGd/o3wgim2CBIkqJ1estEVyL4OXoVAttX 4Ool1aXoymcctYVleSiqH6iGtAPKfzkmIVfsrGTyFPas/PKzURi/yyfsM3vBoSIf 0aUOO0uu9AiXZQsKuU9uSMcOxvtT03CU7ijn0J8N7Sj13Xl210AKQxgGYhiqnCnz 77WAx6Vd1bngNDY4qWdxLgv8nq5+DhsU9Glrx20BODJHxXAO7vK5AQ0EWGJb/gEI ANCjFLwkYsTrK/yQnPmKHedzQOC3KGFV6NCKbx1wA5nd4GfDtoe8ciy+s/IZEsVn 7TRyJIIhUsjIEj7OR+3gQIXM9/+wuwipvjefZvidEIyGtli9qCILmVIz0/Udgywi OnBRbxxdHmpajrQVkc2dTU60j5XRTvW79vIjXZtEYypm9bjd8tokoXx/ixsBg0nb TQ+j/EVNKHLNUxTGiVxUriBovPat1NKmJfuyhWzUNp34sRFCE9tNexG+WJCLB3uK jrt8o3by6zbo0ul/xira6z665djfp17ln9fea5bjoocpcts4rtbdcerzuia/muit lammqvaims+pfjx+nbnwsimaeqeaaykbhwqyaqiacqucwgjb/gibdaakcrdhbbda 0blhv+BUB/9AFnDGTGPxkXkbYFofy1RM+lf+1EnyOSDuvNzt6ur3kRil3Lh51YB9 vmp3wpdznfbygl7y65qte5mdgkktri2ryazb9ujofmf2ffvseycfsgjsxchtkaet 1fqMieNb84hmgS8KVhw5qyLnhbTH266VAOBLF3Sv9l+odjNENFmALcWqebkQOlhi wkwxooj5cafl1wjzsduixhv6go7v8h3t8nydw4hwwlwymdg+vyllhyaguen2hwvv NQOlwRjAuwipceQPmjsd+GJPWcMHU6ocH3thR81pfFY3xLa7R3Yv6KMVjsQv0ru0 M4WCvj7uCGBL4wu+1Gk7r5H6FaynE3Y6 =sw/o -----END PGP PUBLIC KEY BLOCK CRYPTED FILES FOR MEMBERS AND ENTITIES Any member or entity that receives encrypted files from BME, must have or create a couple of GPG keys, one public key and one private key, for each service. Once the keys have being created, each member or entity must send BME the public keys in order to allow BME encrypt the files with this keys. Only the owner of the private key will be able to decrypt the files. All the files created by BME will also be encrypted with BMEs public key, as a result BME will be able to decrypt all the files in order to ensure a file is never unusable. SFTP SERVICE (ORK TR) Page 12 of 37

13 8. SFTP CONNECTION PARAMETERS There are two environnement for the STR SFTP service, training and production. For connecting with this services it is necessary a SFTP client software installed in your operating system. You can download some free clients in internet for the most common operating systems. Next you can read,below, the connection parameters for the SFTP services. The software client used to connect must be compatible with the connection parameters TRAINING IP: Port: Authentication Method: Using User and public key SSH-RSA 2048 BITS Key Exchange algorithm allowed (KexAlgorithms): diffie-hellman-group-exchange-sha256 Message Authentication Code algorithm allowed (MACs): hmac-sha2-512,hmac-sha2-256 Ciphers allowed (Ciphers): aes256-ctr,aes192-ctr,aes128-ctr 8.2. PRODUCTION IP: Port: Authentication Method: Using User and public key SSH-RSA 2048 BITS Key Exchange algorithm allowed (KexAlgorithms): diffie-hellman-group-exchange-sha256 Message Authentication Code algorithm allowed (MACs): hmac-sha2-512,hmac-sha2-256 Ciphers allowed (Ciphers): aes256-ctr,aes192-ctr,aes128-ctr SFTP SERVICE (ORK TR) Page 13 of 37

14 9. CONNECTIVITY FORM ORK-TR Connectivity form Training Environnement Once the fields in salmon color are filled you must send back the form in an editable format. BME will implement the configuration tasks, will fill all the form fields in BLUE and will take back the form for the connectivity tasks. Entity name Entity Data Contact person: Contact Phone: Contact emial address 0.- Request type. Production Environnemennt. For modifications, it is necessasry highlight the modifcations for its monitoring remarqued in YELLOW Add Delete Modification Date Comments SFTP SERVICE (ORK TR) Page 14 of 37

15 Complete the fields for configuring the connectivity ID of the submitting Entity LEI Code Description ID of the entity owner of the information LEI Code Description ID of the entity owner of the information LEI Code Description ID of the entity owner of the information LEI Code Description ID of the entity owner of the information LEI Code Description ID of the entity owner of the information LEI Code Description ID of the entity owner of the information LEI Code Description ID of the entity owner of the information LEI Code Description ID of the entity owner of the information LEI Code Description SFTP SERVICE (ORK TR) Page 15 of 37

16 1.- SFTP Connectivity Required: Connection to the BME net Open SSH 7.4 Client (Winscp, Filezilla, etc..) A couple of SSH-2 RSA private/public key must be created, with encodying of 2048 bts.the public key must be sended to BME in a text file format. If the connection is done through the shared net lines for another services, it will be configured a bandwidth no bigger than 0, 5 Mb. EOF format is windows mandatory. (CRLF) Client SFTP IP adddress (NAT address to be presented to BME) Filename with the SSH public key Filenames with the GPG encoding public keys (extension.asc) Entity Technical data Technical Data provided by BME Protocol SFTP SFTP server port in BME Internet SFTP server IP address User code (LEI code in lower case) Subfolder in the BME server where you can download the entity files Subfolder in BME server where you can upload your entity files. fstr_lei /filesout /filesin Comments: SFTP SERVICE (ORK TR) Page 16 of 37

17 ORK-TR Connectivity form Production Environnement Once the fields in salmon color are filled you must send back the form in an editable format. BME will implement the configuration tasks, will fill all the form fields in BLUE and will take back the form for the connectivity tasks. Entity Data Entity name Contact person: Contact Phone: Contact emial address 0.- Request type. Production Environnemennt. For modifications, it is necessasry highlight the modifcations for its monitoring remarqued in YELLOW Add Delete Modification Date Comments SFTP SERVICE (ORK TR) Page 17 of 37

18 Complete the fields for configuring tehe connectivity ID of the submitting entity LEI Code Description ID of the entity owner of the information LEI Code Description ID of the entity owner of the information LEI Code Description ID of the entity owner of the information LEI Code Description ID of the entity owner of the information LEI Code Description ID of the entity owner of the information LEI Code Description ID of the entity owner of the information LEI Code Description ID of the entity owner of the information LEI Code Description ID of the entity owner of the information Código LEI Description SFTP SERVICE (ORK TR) Page 18 of 37

19 1 SFTP Connectivity Required: Connection to the BME net Open SSH 7.4 Client (Winscp, Filezilla, etc.) A couple of SSH-2 RSA private/public key must be created, with encodying of 2048 bts.the public key must be sended to BME in a text file format. If the connection is done through the shared net lines for another services, it will be configured a bandwidth no bigger than 0, 5 Mb. EOF format is windows mandatory. (CRLF) Client SFTP IP adddress (NAT address to be presented to BME) Filename with the SSH public key Filenames with the GPG encoding public keys (extension.asc) Entity Technical data Technical Data provided by BME Protocol SFTP SFTP server port in BME Internet SFTP server IP address User code (LEI code in lower case) Subfolder in the BME server where you can download the entity files Subfolder in BME server where you can upload your entity files. pstr_lei /filesout /filesin Observaciones: SFTP SERVICE (ORK TR) Page 19 of 37

20 10. ANNEX ANNEX I: BASIC GPG COMMANDS How to create public/private keys. For the creation of the keys the following instruction must be executed: gpg --gen-key The system will ask for the kind of key. RSA and RSA option must be selected. Please select the type ok key desired: (1) RSA y RSA (default) (2) DSA y Elgamal (3) DSA (only firm) (4) RSA (only firm) Por favor seleccione tipo de clave deseado: (1) RSA y RSA (predeterminado) (2) DSA y Elgamal (3) DSA (sólo firmar) (4) RSA (sólo firmar) After that, you have to introduce the size of the key. The recommended size is 2048 bits. RSA keys size can be between 1024 and 4096 bits. Key size? (2048) Normally the key has an expiration date. If you do not want the key to expire, please select the option 0. Please, indicates the value time for the key. 0 = The key never expires SFTP SERVICE (ORK TR) Page 20 of 37

21 <n> = The key expires in n days <n>w = The key expires in n weeks <n>m = The key expires in n months <n>y = The key expires in n years key value(0)? 0 Por favor, especifique el período de validez de la clave. 0 = la clave nunca caduca <n> = la clave caduca en n días <n>w = la clave caduca en n semanas <n>m = la clave caduca en n meses <n>y = la clave caduca en n años Validez de la clave (0)? 0 Finally, it s necessary to introduce the id for the key use. It s important to remember this id for the export and decrypt files actions. The data required are: Name and surname, address (which will be used for the exportation) and comments How to export a public key For the exportation proccess you must use the id mentioned in the generation key process. You can use name as well, name, username or address. In the example below, we will use the address and the command will create a file with the name clave.asc : gpg --export --armor correo@dominio.com > clave.asc How to import a public key The process requires the execution of this command gpg --import clave.asc SFTP SERVICE (ORK TR) Page 21 of 37

22 How to encrypt a file The file encryption requires as well the id and the key with which we want to make the decrypt action. You can use as well the name, surname or address. gpg --output fichero.gpg --encrypt r correo@dominio.com fichero How to decrypt files Decrypting files command: gpg --output doc --decrypt doc.gpg SFTP SERVICE (ORK TR) Page 22 of 37

10.2. ANNEX II: CLIENT SFTP USE EXAMPLE. 10.2.1. Downloading and installing WinSCP Spftware This guide contains simplified description of downloading and installing WinSCP, for allowing the connection with a SFTP server.

23 10.2. ANNEX II: CLIENT SFTP USE EXAMPLE Downloading and installing WinSCP Spftware This guide contains simplified description of downloading and installing WinSCP, for allowing the connection with a SFTP server Download software The software is available in the link below. Download will start automatically Installation Open the installation program by double clicking on its icon. The software will select automatically the OS language. On Welcome and License Agreement screens click Next. SFTP SERVICE (ORK TR) Page 23 of 37

24 You will be prompted to select a setup type. For basic setup, choose Typical Installation. Keep default values for NC or Commander interface and click Next SFTP SERVICE (ORK TR) Page 24 of 37

Click Install to start the installation A brief installation process will take place.

25 After you select the interface, the Ready to Install screen opens. On this screen, you can review the installation options you have selected. Click Install to start the installation A brief installation process will take place. You may have to restart your computer. If you choose not to restart, some WINSCP functions may not be available until you do so. SFTP SERVICE (ORK TR) Page 25 of 37

26 Configuration of the SFTP connection Start the WinSCP application. Before you connect, you need to know at least: Host Number : IP Address File Protocol : SFTP Port : 22 User name : Account username Select your File Protocol, enter your host name to Host name field and username to User name field After that some configurations ítems must be changed. To do that we select Preferences option like in the image below. SFTP SERVICE (ORK TR) Page 26 of 37

27 In order to generate the logs files, click the option marked in yellow in the image. To prevent the automatic upgrading of the software it is necessary to uncheck the option marked in yellow in the Update menú. SFTP SERVICE (ORK TR) Page 27 of 37

28 Public / Private key generation For connecting to the SFTP server using a public key authentication or SSH Keys instead you need to generate a key pair using the PuTTYgen application. You will find this application into the Tools Menu SFTP SERVICE (ORK TR) Page 28 of 37

Select the Run PuTTYgen option. At this moment, you have to generate a new public/private key pair. 10.2.1.5.

29 Select the Run PuTTYgen option. At this moment, you have to generate a new public/private key pair Public key generation Press Generate button and follow the instructions. SFTP SERVICE (ORK TR) Page 29 of 37

30 Generate some randomness by moving the mouse over the blank area marked in red below Once you have generated the key, click Save public Key button SFTP SERVICE (ORK TR) Page 30 of 37

31 Click on the affirmative option Choose the location where you want to save the public key. SFTP SERVICE (ORK TR) Page 31 of 37

32 After that, we proceed in the same way with the Private Key. SFTP SERVICE (ORK TR) Page 32 of 37

10.2.1.6. Private key generation Click in the Save private key button.

33 Private key generation Click in the Save private key button. In the new Windows that appears, choose the affirmative option. Choose the location where you want to save the private key SFTP SERVICE (ORK TR) Page 33 of 37

34 At this point, we have finished with the creating keys application. SFTP SERVICE (ORK TR) Page 34 of 37

35 Authentication settings for the SFTP connection We continue, in the Login-WinSCP window, clicking in the Advanced button. In the new Windows we choose the SSH > Authentication option SFTP SERVICE (ORK TR) Page 35 of 37

36 Check the Allow agent forwarding option and select the private key file Click in OK button At this point, the creating public/private key process has finished. SFTP SERVICE (ORK TR) Page 36 of 37

37 SFTP server connection For establishing the connection, just select the connection created and click the Login button SFTP SERVICE (ORK TR) Page 37 of 37

Due: October 8, 2013: 7.30 PM

Due: October 8, 2013: 7.30 PM Jackson State University Department of Computer Science CSC 437-01/539-01 Computer Security Fall 2013 Instructor: Dr. Natarajan Meghanathan Lab Project # 1: Lab Project on using PGP GNU Privacy Guard (GPG)