Anybody using Cloverleaf for EDI with secure FTP?

Ken,

Is this SFTP or FTPS (they are  different but are sometimes both called ‘secure FTP’)?

If it is FTPS, then yes I have – you will need the additional cost secure socket add-on for Cloverleaf to use SSL (which is for FTPS).

We did not have any choice it was outside the 4 walls and that is what the trading partner wanted.

I believe Cloverleaf 5.8 also supports SFTP but am unsure of the need for the Secure Sockets add-on.

However, you could always write your own Tcl code (as a UPOC protocol I suppose) and deploy the tclCurl package that is there in 5.6 and later.

Ken,

We are delivering a file using sftp because that is the only way the vendor would accept it.  It required custom Tcl code in 5.7.  I understand sftp is a supported protocol in 5.8, and plan to use that after our next upgrade.

Ken:

I wrote an expect script to SFTP/put a file from our Cloverleaf server to a vendor (TeleVox) outside our firewall and it has worked just fine.

I already have a clovertech post from before showing the script and how I call it at this URL:

https://usspvlclovertch2.infor.com/viewtopic.php?t=2659

Plain old FTP is no longer endorsed by our security department and they have choosen SSH/SFTP as the desired replacement.

A downfall I have run into with SFTP is that when the server fails over and now has a different SSH-key on the new active node you have to update your known_hosts file with the new entry.

You can add multiple entries in the known_host file for the same IP/hostname to help with this.

Unfortunately, the SSH-kesy on the current known_hosts will change sometimes with various OS patches that impact SSH and your knonw_hosts entires will have to be updated everytime the SSH key changes on one of the foriegn SSH/SFTP servers that you log into.

… your knonw_hosts entires will have to be updated everytime the SSH key changes on one of the foriegn SSH/SFTP servers that you log into.

This is a security feature.  It prevents someone from setting up another server that mimics a real server and tricks people into logging in to the wrong server (possibly through DNS attacks).

FTPS addresses this issue by using SSL certificates that are signed by a CA, but enough people are using self-signed certificates for their servers that is common to ignore CA signature errors altogether.