Plex runtime environment communication encryption

[MARUBUN SUPPORT]

Hi Team,

I received a question from a customer and would like to confirm it.

[Environment]
We are connecting from a client PC to an IBM i machine via TCP/IP in a Plex runtime environment.
The client object is WinC (C++) and the server object is RPG400.

[Question]

Q1. Is the login password for the connection to the IBM i machine encrypted?

-> I assume the password for logging into this system is encrypted, is that correct?

Q2. Is data encrypted during communication in this environment?

-> Data in communication is not encrypted and must be encrypted using an external tool or other means.

Q3. If the data is not encrypted, is there a way to encrypt it for WinC (C++) - RPG400?

-> Is there any way about encryption?

Thanks,

[Arun Painuly]

Hi Marubun Support,

Thank you for sharing the concerns here, please find the answers below inline.

[Question]

Q1. Is the login password for the connection to the IBM i machine encrypted?

-> I assume the password for logging into this system is encrypted, is that correct?

[Plex2E Team] Yes, it's encrypted.

Q2. Is data encrypted during communication in this environment?

-> Data in communication is not encrypted and must be encrypted using an external tool or other means.

[Plex2E Team] No. Enabling VPN connection could be one option.

Q3. If the data is not encrypted, is there a way to encrypt it for WinC (C++) - RPG400?

-> Is there any way about encryption?
[Plex2E Team] We have implemented one SSH Tunneling utility for Plex C#/WinC/Java/RPG runtime to enable SSH Tunneling to secure Plex generated application's client/server communication. Please refer to the Knowledge Base article for complete details - https://knowledge.broadcom.com/external/article/375662/plex-crpg-runtime-with-ssh-tunneling-to.html

Please do let us know if you need further details on this.

Thank you.

Regards,
Plex2E Team

[MARUBUN SUPPORT]

Thanks for the answer.
Customer contacted me with the following

---
I have tried to set up a connection using the KB as a reference.
I am trying to set up SSH tunneling with WinC(C++) - RPG400 as the client and server combination, 
but when I press the “START - SSH Tunnel for IBM i Dispatcher” button, 
I get the following message and cannot make the connection.

Faild to establish the SSH Connection!!!

The connection could not be made because it was rejected by the target computer.

What should I check about this?
In the CA PlexIBMi Dispatcher details section, we are entering the connection information that is currently available in the [Remote] section of the INI file of the application EXE that is connected to the IBM i machine.
The IP address of the IBM i machine is entered in the System field.
---

Thanks,

[Arun Painuly]

Hi Marubun Support,

The error encountered while starting the SSH tunnel suggests either that the server is not configured for SSH or there is a firewall issue between the client and server machines.

To begin troubleshooting, please verify that the client and server machines can connect via SSH protocol. You can do this by using an SSH client such as Putty on the client machine to connect to the server.

Please refer to the Putty configuration steps below:

- Enter the Server name/IP address.

- Select "SSH" as the Connection Type.

- Click the "Open" button.

If SSH protocol is enabled on the server side, a terminal window should open and prompt for server credentials.

Please let us know your feedback how it goes in your environment.

Thank you.

Regards,
Plex2E Team

[MARUBUN SUPPORT]

Hi Team,

We received the following message from a customer regarding this matter, but is it possible to respond?
-

Could you please tell me the steps to configure the server (IBM i machine) for SSH?

-

Thanks,

[Arun Painuly]

Hi Marubun Support,

Please follow the below details to verify the SSH installation and to start the SSH service on SystemI.
 
#1. Verify SSH Installation
You can check for its installation using the following command:

        DSPSFWRSC

Look for product 5733SC1 in the output list. 
E.g. Similar to the below entry in command output list will be present: 
       5733SC1   1        5050    OpenSSH, OpenSSL, zlib 

If it's not installed, you'll need to install it from your IBM i installation media or download it from IBM.

#2. Start the SSH Daemon
Run the below command to start the SSH server.

        STRTCPSVR SERVER(*SSHD)

The SSH daemon will now be active and listening for incoming connections on the default port 22.
Now, you can connect any SSH client (like Putty) to connect to SSH server on SystemI.

Thank you.

Regards
Plex2E Team

[MARUBUN SUPPORT]

Thank you for your help as we have received additional questions from our customers.

---

I confirmed that SSH was installed by running the DSPSFWRSC command.

When I ran STRTCPSVR SERVER(*SSHD),
I got the message "The SSHD server is starting."

However, I checked by running WRKTCPSTS OPTION(*CNN), and port 22 does not exist.
Just to be sure, I searched for ssh, thinking that a port other than the default 22 might be set, but I was unable to find it.

I ran the command WRKACTJOB JOB(QP0ZSPW*) to check if job QP0ZSPWT or QP0ZSPWP was running, but I got the message "(No active jobs to display)."

What should I check?

---

Thanks,

[Arun Painuly]

Hi Marubun Support,

The command STRTCPSVR SERVER(*SSHD) initial output "The SSHD server is starting.", shows that SSHD is available on the system. Not sure though if SSHD server has started successfully. Ask AS/400 Admin person to ensure that SSHD server has successfully started, and there is no errors reported on server startup.

Hope that help.

For a quick check, you can run the Putty client on Windows machine to connect to AS/400 server using SSH.

Thank you.

Regards,
Plex2E Team

[MARUBUN SUPPORT]

Here's a customer report and additional question:

-
I was able to start the SSH server by running the following command:
 
QSH CMD('/QOpenSys/usr/sbin/sshd')
 
I'm using PlexSSHTunnelingUtility.exe to check its operation, but does the screen launched by PlexSSHTunnelingUtility.exe need to be left running all the time?

The screen displays the connection status to the IBM i machine, so I don't want the operator to see this information, so I'm wondering if there's a way to hide it.
-

Thanks,

[MARUBUN SUPPORT]

Is there any way to hide it?

---

I'm using PlexSSHTunnelingUtility.exe to check its operation, but does the screen launched by PlexSSHTunnelingUtility.exe need to be left running all the time?

The screen displays the connection status to the IBM i machine, so I don't want the operator to see this information, so I'm wondering if there's a way to hide it.

---