Re: Native sFTP?

[Lukas Beeler <lukas.beeler@xxxxxxxxxxxxxxxx>]

On Sat, Apr 25, 2009 at 06:08, John McKee <jmmckee@xxxxxxxxxxxxxx> wrote:
> At one time, I toyed with the idea of attempting to translate the code to RPG
> IV. ÂNever really got started on it, so have no idea if the translated code
> would have even worked. ÂMy efforts, had I attempted it, would have likely been
> a hand translation. ÂLots of code involved. ÂMight be possible to write an RPG
> IV program that could do the translation. ÂBut, again, the question comes back
> to whether the resulting application would actually work.

Rewriting a security critical and cryptography heavy application like
an SFTP client in RPG sounds like a maintenance and security nightmare
to me. It requires a lot of knowledge of cryptography and to some
extent system level programming in order to get all the authentication
possibilities and configuration capabilities down and secure.

OpenSSH is an extremely big open source project, with a wealth of
developers working on it, and they have security issues from time to
time. Doing this as a one man project from scratch seems like the
wrong approach to me.

Patching OpenSSH to compile as native ILE C program seems more
feasible, albeit maintaing such a patch against a moving target like
OpenSSH is also not easy, especially the fact that you have to be fast
in responding to security critical fixes.

This all seems like a lot of effort with little gain - creating a
wrapper around existing OpenSSH PASE ports seems like a better idea -
less maintenance, less chance of it breaking and you won't have to
deal with critical security issues and cryptography problems.