File transfer clients manual File Delivery Services

File transfer clients manual File Delivery Services

Publisher Post CH Ltd Information Technology Webergutstrasse 12 CH-3030 Berne (Zollikofen) Contact Post CH Ltd Information Technology Webergutstrasse 12 CH-3030 Berne (Zollikofen) IT261 FDS Operation E-mail: fds@post.ch Version 4.0 / February 2016 Download the latest version from: https://www.post.ch/fds File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 2/29

Table of contents 1. General... 4 1.1 Purpose... 4 1.2 Definitions, acronyms and abbreviations... 4 1.3 Names, prices, versions, etc.... 4 2. SFTP... 5 2.1 Introduction... 5 2.2 Security... 5 2.2.1 Encryption algorithms... 5 2.2.2 Message Authentication Codes (MAC)... 5 2.3 Public and private key... 6 2.3.1 Creating an SSH key pair with PuTTY... 6 2.3.2 Creating an SSH key pair with OpenSSH... 10 3. FTP... 11 3.1 brief overview... 11 3.2 Password policy... 11 3.3 Changing the password... 11 3.3.1 Command-Line FTP Client... 12 3.3.2 Graphic FTP clients... 12 3.3.2.1 WS_FTP... 12 3.3.2.1.1 FileZilla... 13 3.4 Transmitting data in ASCII and/or binary mode... 13 4. Connection to FDS... 14 4.1 Introduction... 14 4.2 Test of the connection... 14 5. FileZilla... 15 5.1 Importing a key with FileZilla... 15 5.2 Automatic import with PuTTY s Pageant... 16 5.3 Notes on FileZilla... 18 6. CuteFTP... 19 6.1 Importing a key with CuteFTP... 19 7. WS_FTP Professional... 23 7.1 Importing a key with WS_FTP Professional... 23 8. WinSCP... 28 8.1 Importing a key with WinSCP... 28 8.2 Notes on WinSCP... 28 File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 3/29

1. General 1.1 Purpose FDS customers use very different types of software clients and scripts to transfer data. In order to counteract this influx of clients, we have decided to test those that are used the most and to describe the most important functions and thus restrict usage and support to these areas. 1.2 Definitions, acronyms and abbreviations Word FTP SSH SCP SFTP PuTTY Definition File Transfer Protocol SSH or Secure Shell refers to both a network protocol and the respective programmes that are used to establish an encrypted connection with a remote computer in a secure manner. Secure CoPy or SCP is a protocol for the encrypted transmission of data between two computers in a computer network. SFTP or SSH File Transfer Protocol is a further development of SCP and enables the secure transmission of data to remote systems. PuTTY is a free SSH client, developed by Simon Tatham for Microsoft Windows. 1.3 Names, prices, versions, etc. Software price version* (2 2016) ftp sftp (ssh) url FileZilla (filezilla project) free 3.15.0 yes yes https://filezilla-project.org/ ("recommended") CuteFTP Professional charged 9.0 yes yes http://www.cuteftp.com/ (globalscape) WS_FTP Professional charged 12.4 yes yes http://www.ipswitchft.com/ (Ipswitch) WinSCP free 5.7.6 yes yes http://winscp.net *Although previous and future versions of software, similar to other SFTP and FTP clients should generally function without a problem with FDS, our IT unit can only provide limited support for problems that occur with versions/software not listed here. File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 4/29

2. SFTP 2.1 Introduction SFTP (SSH Secure File Transfer Protocol) is a file transfer protocol and a secure alternative to FTP. The connection between client and server is encrypted, making it impossible for an outsider to observe and collect data. By using Public-Key authentication, the integrity and confidentiality of the data exchanged is ensured. SSH assures that data are complete and unchanged from sender to receiver. Attention: to correct common misconceptions, SFTP is not FTP over SSH (sometimes called Secure FTP), nor is it particularly like FTP at the protocol level. It should also not be confused with FTPS (FTP over SSL). The FDS SFTP server supports: version 2 SSH, version 3 SFTP protocol, inbound SCP commands using SSH/SCP protocol, as supported by OpenSSH. Note that SCP does not support list, delete or rename, transfers of files 15 Gigabytes in size, 30 concurrent inbound connections from the same user account, user account locking for 30 minutes after 5 failed attempts, SSH keys in OpenSSH, ssh.com and PuTTY format, more than 1 SSH key for each user account. The FDS SFTP server does not support: version 1 SSH, interactive shell session, transfer resumption, change of password, change of file attributes, manipulations of the directories structure. 2.2 Security The FDS customers must ensure that their file transfer software are up-to-date. It is particularly important that only encryption algorithms and message authentication codes (MAC) considered as safe are used. Post CH Ltd and its service and business units will not assume responsibility or liability for any damages that are incurred due to the use of unsecure algorithms and/or MAC methods. 2.2.1 Encryption algorithms The AES algorithm has to used and with a key length of at least 128 bits. Information Technology Post reserves the right to not support unsafe algorithms (like as example twofish, blowfish or arcfour) or algorithms with a key length < 128 bits anymore and this without advance notification. 2.2.2 Message Authentication Codes (MAC) MAC is a symmetric encryption method used to ensure the integrity of a message. A safe MAC procedure is hmac-sha2-256. Information Technology Post reserves the right to not support unsafe MAC (like as example hmac-sha1 or hmacmd5) anymore and this without advance notification. File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 5/29

2.3 Public and private key With the help of an encryption system, messages can be digitally signed and encrypted within a network and when the parameters are chosen carefully (e.g. key length) they will not be 'cracked' any time soon. An asymmetrical crypto-system is a type of encryption in which each of the communicating parties has a key pair. This pair is composed of a private key and a public key. The public key enables anyone to encrypt data for the holder of the private key and to check or authenticate the digital signatures. The private key enables its holder to decode data that has been encrypted with the public key and to generate or authenticate digital signatures. However, the sender needs the public key of the recipient for each encrypted transmission. This can be sent by e-mail, for example, or be downloaded from a web site. - The public key has to be sent to Swiss Post (in accordance with the instructions in the FDS letter of confirmation) and is stored on the Swiss Post FDS server. - The private key must remain on your computer and may NEVER be given to others! - The pair of keys must be generated by the participant. - FDS supports both RSA (Rivest-Shamir-Adleman) or DSA (Digital Signature Algorithm) keys algorithms. - It is required to use a minimum of 4096 bits for the generated key. NOTE: It is highly recommended to protect the key file with a passphrase. This will encrypt the private key when it is saved in a secure location on the local machine. Using passphrases for batch SSH-keys requires familiarity with the SSH-agent authentication subsystem. Participants should be aware that the use of strong encryption methods and encrypted SSH-keys is advisable but will raise administration efforts and system complexity. 2.3.1 Creating an SSH key pair with PuTTY PuTTY is an open source software for Microsoft Windows. It can be downloaded at http://www.putty.org. Beside a SFTP client (putty.exe) puttygen offers the possibility to generate key pairs. Start PUTTYGEN File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 6/29

Check whether SSH-2 (RSA or DSA) and at least 4096 (bits) are selected and then: Click "Generate" 2048 Move the cursor over the blank area File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 7/29

When it is ready, the mask appears with the keys. Select "Save public key" Give the "public key" a name that makes sense, and save it File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 8/29

Select "Save private key" It is highly recommended to protect the key file with a passphrase. This will encrypt the private key when it is saved in a secure location on the local machine. Using passphrases for batch SSH-keys requires familiarity with the SSH-agent authentication subsystem. Participants should be aware that the use of strong encryption methods and encrypted SSH-keys is advisable but will raise administration efforts and system complexity. In this example we will continue without passphrase. PLEASE NOTE: The private key must remain on your computer and may NEVER be given to others! Give the "private key" a name that makes sense, and save it File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 9/29

2.3.2 Creating an SSH key pair with OpenSSH OpenSSH is available for any UNIX operating environment and common Linux distributions. Further information about OpenSSH is available at: http://www.openssh.com Below is an example of the generation of a key pair using OpenSSH: ssh-keygen -b 4096 -t rsa -f /tmp/demo_key -C "comment for demo key" Here is an example of a private key: # cat /tmp/demo_key -----BEGIN RSA PRIVATE KEY----- MIIJKAIBAAKCAgEAybf8vCaIZc8pSTgpbVUD3aBVC1AnKfBHIqGZA9E7w/TMcs9p meou4nfb9vhqbxptwlg/qftg6xrcxhlcjwfe3rv5eq3sbj3tvlqiz89sh/gg21si < --- SNIP --- > ACdBLStDxIURm03gmMcBhKHDq4owQlDyESva0LWhIaxFwHpzamOAbPYVqBMbqT38 Bc1eGl0EE4d3yyWoMLOpwbsbhbmjSUjVV4JeDpNciqADBK5mQ3HNGNyKNqQ= -----END RSA PRIVATE KEY----- And here is an example of a public key (this one is automatically generated with the ending.pub): # cat /tmp/demo_key.pub ssh-rsa AAAAB3NzaC1yc2EAAAADAQABA < --- SNIP --- > 6mEO5Gh28Vw== comment for demo key File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 10/29

3. FTP 3.1 brief overview The FTP protocol comes from the early days of the Internet, which is quite different from what it is today. At that time, data needed to be transmitted from one computer to another. There was no need for a virus scanner and firewall. The original FTP protocol therefore has a characteristic that is sometimes problematic in combination with some firewalls. To get round the typical FTP problems, a modified FTP protocol has been developed known as "Passive FTP". This is particularly an issue in relation to firewalls and Internet access. Typically, the FTP service uses two ports rather than one: port 21 for control (control port) and port 20 for the data (data port). But the main problem of FTP is its lack of security as all data including username and password are transmitted in clear text. For this reason the use of FTP is forbidden for new internet customers since June 2015. Existing customers will have to change to the protocol SFTP until December 2018. The FDS FTP server supports: transfers of files 15 Gigabytes in size, 30 concurrent inbound connections from the same user account, user account locking for 30 minutes after 5 failed attempts, change of passwords with the SITE command. The FDS FTP server does not support: transfer resumption, change of file attributes, manipulations of the directories structure. 3.2 Password policy Passwords are valid for a maximum of 90 days and have to be changed by the end of this period at the latest. If this is not done, the FDS system will no longer allow access. The last 24 defined passwords may not be used again. The new password is activated immediately. Passwords have to be at least 8 digits long and can be up to a maximum of 28 digits long. Passwords that are reset by Post CH Ltd s FDS must be changed after they have been used for the first time. Passwords must contain at least two of the following characters:!, @, $, %, &, ^, *, numerals [0-9], uppercase letters [A-Z]. Creating passwords by simply "counting up" is not recommended (example: MyPaWo-01, MyPaWo-02, MyPaWo-03, ). Passwords must be chosen so as to be difficult to guess. Passwords should therefore not be composed of identical or consecutive letters or numbers, or of a simple row of keys on the keyboard, nor should they be made up of well-known words. 3.3 Changing the password The FTP command to change the password must follow this format: site cpwd <new-password> Below, 3 examples are given with a command line, showing two graphic FTP clients. If your graphic FTP client does not support the function "Execute FTP command" you can resort to the Windows DOS FTP client to change the password. File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 11/29

3.3.1 Command-Line FTP Client ~> ftp d fds.post.ch Connected 220 FDS FTP Server ready. ftp_login: user `<null> pass `<null> ---> USER ftpuser1 331 Password required for ftpuser1. ---> PASS XXXX 230 User ftpuser1 logged in. ---> SYST 215 UNIX Type: A Remote system type is UNIX. ---> site cpwd 2short 550 Requested action not taken. password violates policy. ---> site cpwd this!is!good! 200 command successful. ---> QUIT 221 Goodbye. 3.3.2 Graphic FTP clients 3.3.2.1 WS_FTP In order to change the password with the graphic FTP client "WS_FTP", proceed as follows: Description In the display of the FDS server, open the context menu with the right-mouse key. Select the "Operation" menu item. Screenshot Open the "FTP Commands" sub-menu followed by the "SITE" sub-menu. File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 12/29

In the "Site command" window enter the command: site cpwd <new-password> and confirm by clicking OK. In the Log window you can check whether the command has been executed. 3.3.2.1.1 FileZilla In order to change the password with the graphic FTP client "FileZilla", proceed as follows: Description With FileZilla open, go to the "Server" menu and open the "Enter custom command" sub-menu. Screenshot In the open input window enter the command site cpwd followed by your new password. Confirm your input with OK In the Log window you can check whether the command has been executed. 3.4 Transmitting data in ASCII and/or binary mode When files are transferred we differentiate between two different modes: ASCII mode, which is exclusively for text files and binary mode, which is for all other files. ASCII Binary In ASCII mode, the line structure of the source computer is converted to the line structure of the target computer, during which code conversion can take place (e.g. EBCDIC --> ASCII). In binary mode, the file is transmitted byte by byte, which is important with regard to archive files. Binary files have to be transmitted in this mode to ensure that random byte combinations, which represent the line break to be converted (as in ASCII mode) are not changed by accident, which, in a worst-case scenario, would render the binary file useless. File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 13/29

4. Connection to FDS 4.1 Introduction The FDS customer may use the file transfer client of their choice. Our IT unit can only provide limited support for problems that occur with versions/software not listed here as well as for the implementation of transfer solutions. The FDS server is reachable at the address fdsbc.post.ch (internet and leased lines) or fdsbc.pnet.ch (internal post network). The FDS protocols are running on standard ports (21 for FTP and 22 for SFTP). Relevant details like user name, names of directories, file names, schedule of transmission, etc. are communicated during the service ordering by the respective customer services of the business unit of Post CH Ltd. Planned service maintenances are published on https://www.post.ch/fds 4.2 Test of the connection The connection to FDS can be tested using telnet: # telnet fdsbc.post.ch 22 Trying fdsbc.post.ch... Connected to fdsbc.post.ch. Escape character is '^]'. SSH-2.0-SFTP Server # telnet fdsbc.post.ch 21 Trying fdsbc.post.ch... Connected to fdsbc.post.ch. Escape character is '^]'. 220- Welcome to Swiss Post FDS FTP Server 220 Server ready for new user. Please note: the FDS server is using 2 IP addresses. Both addresses can be identified using multiple DNS lookup (nslookup fdsbc.post.ch for instance). The IP addresses may only be used for the configuration of firewall rules. For the connection from your application to the FDS server, it is essential that you use the domain name. In case the FDS server is not reachable, please assure that your firewall does not block the connection. In order to get an efficient help from our side, it is important to provide all needed information (user name, error message, exact time of the concerned connection, file and directory names). File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 14/29

5. FileZilla 5.1 Importing a key with FileZilla In FileZilla you can import keys in PuTTY format as well as in OpenSSH format. Start FileZilla => Edit => Settings => SFTP => Add keyfile (then select the correct private key file) This (yellow) line indicates that the key has been imported successfully. File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 15/29

5.2 Automatic import with PuTTY s Pageant "Pageant" (PuTTY authentication agent) is an SSH agent which can be used to pass on SSH authentications. Pageant can import keys and make local programmes available when requested. The interface is open, meaning that other programmes can connect up with this service by Pageant. Start PAGEANT.EXE Pageant embeds itself in the System Tray on the right underneath the Quickstart bar and shows all the sessions that are saved in Pageant. This icon appears in the task bar: File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 16/29

Once it has been opened the "Pageant Key List Window" opens, which at this point is still empty: Select the private key (*.ppk) via "Add Key" and confirm by clicking "Open. Only keys in PuTTY format will be accepted here. If the key appears as in the following example it has been imported correctly and is now located in the computer s memory. Diverse "SSH programmes" and above all, FileZilla, now have direct access to the key from the memory. File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 17/29

5.3 Notes on FileZilla Swiss Post also uses an IDS/IPS system as one of its protection mechanisms. To avoid being locked out, we recommend limiting the number of transmissions taking place at the same time to one or two at the most! File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 18/29

6. CuteFTP 6.1 Importing a key with CuteFTP => Tools => Global Options File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 19/29

In Security: Select "SSH2 Security"! Activate the "Use public key authentication" field File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 20/29

In "Public key path" click "Folder": and select the correct key (.pub). File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 21/29

In "Private key path" click "Folder": and select the correct private key (.ppk). Here are the correctly imported keys: and for an automatic login without a password: Disable the "Use password authentication field"! File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 22/29

7. WS_FTP Professional 7.1 Importing a key with WS_FTP Professional Select => Options => SSH and => Client Keys File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 23/29

Select => Import => Public Key File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 24/29

=> here select: MUSTER.pub : followed by "Open" => Next File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 25/29

Select => Private Key => here select: MUSTER.ppk: followed by "Open" File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 26/29

=> Next click: "Finish" File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 27/29

8. WinSCP 8.1 Importing a key with WinSCP 1) Start WinSCP 2) Click Advanced 3) then click on Authentication Click " Field" and select the private key 8.2 Notes on WinSCP If you have problems with permissions after uploading files, this can be rectified by going to File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 28/29

"Advanced " => Transfer Setting Rule => Disable the "Set permissions" option and activate the "Ignore permissions errors" fields. "Advanced " => Transfer Setting Rule => enable the "Ignore permission error" option. File transfer clients manual Version 4.0 / February 2016 / Post CH Ltd 29/29