SFTP Feature Product Bulletin

SFTP (Secure File Transfer Protocol) feature is an optional module that provides encrypted consist and maintenance transport from the APU102 to a host system.

This document describes the installation and configuration of the SFTP client feature.

The described procedures are “generic”. Customer-specific procedures are described elsewhere.

Supported Hardware

The SFTP feature requires the LX800 processor module; the LPM-TX processor is not supported.

Contents

This document covers installation of the SFTP update and describes authentication (login) to an SFTP server.

See Also

To use public-private key authentication, see provided Sample BAT File.

Installation

The update payload is large so a fast and reliable link is required for installation.

Disclaimer

Comet Electronics makes no guarantees whatsoever regarding the suitability or security of any third-party software such as WinSCP, PuTTY, or TeraTerm. Use at your own risk. It is up to the user to establish that software is genuine, properly licensed, and compliant with any company Information Technology (IT) policies. Contact your IT department for guidance.

File Transfers Using ZMODEM over SSH

This note applies only if communications with the APU102 is by SSH. Plain Telnet connections are not affected. In the current version of the SSH (Secure SHell) feature, ZMODEM transfer to send/receive file is not reliable. As an alternative, SCP is supported (and is easier to use than ZMODEM). FTP may also be available (depending on APU102 settings).

Installation Details

Installation involves two steps: uploading the update payload (the three files noted earlier) and rebooting the APU102 to complete installation. The following shows step-by-step instructions for each of the supported upload methods.

Three files are sent to the APU102:

INSTSFTP.EXE
F.BAT
ZIP.PSP

Telnet

If Telnet connections are permitted, the ZREC command may be used to upload the update payload. (Note: ZMODEM over SSH is not reliable in the current software.)

1. Connect to the APU102 using a Telnet client such as Tera Term.
2. Login to Session #1 and use the C command to enter Change mode.
3. For each of the three files, use the ZREC command and then send the file using ZMODEM transfer
4. Reboot the APU102 (R command).

FTP

If the FTP server on the APU102 is enabled, an FTP client such as WinSCP or FileZilla may be used to send the update.

1. Open an FTP session using the IP address for the APU102 being updated.
2. Login using credentials provided by Comet.
3. Navigate to the D:\AEI directory.
4. Upload three update files.
5. Close FTP session.
6. Connect to the APU102 using a Telnet client or SSH client (if SSH is enabled).
7. Login to Session #1 and use the C command to enter Change mode.
8. Reboot the APU102 (R command).

SCP

If SSH is enabled, an SCP client such as WinSCP may be used to upload the update payload.

1. Open an SCP session using the IP address for the APU102 being updated.
2. Login using credentials provided by Comet.
3. Navigate to the D:\AEI directory.
4. Upload three update files.
5. Close SCP session.
6. Connect to the APU102 using a Telnet client or SSH client (if SSH is enabled).
7. Login to Session #1 and use the C command to enter Change mode.
8. Reboot the APU102 (R command).

Configuration

Configuration is customer specific. Consult Comet for guidance.

In general, configuration consists of installing appropriate access (ACC) files describe how the APU102 is to deliver consist and maintenance reports to a server. Parameters for report delivery are changed to specify the appropriate SFTP ACC files (AEIReportConnect and MaintReportConnect settings accessed using the EP command).

In the case of SFTP, the ACC file specifies that the APU executes a BAT (batch) file which consists of a list of Windows commands to prepare and deliver the report payload.

These BAT files are customized to meet each customer’s requirements. See Sample BAT File for an example.

Testing

1. When the unit is running, connect again (don’t need Change mode at this point) and run the ST (Simulate Train) and SM (Simulate Maintenance event) to trigger reporting.
2. Verify that the events are correctly reported to the railroad host system.
   
   

Procedure Complete.

Description of Changes

This update includes:

• - Updated “curl.exe” package
• - Updated report delivery scripts (ACC files). The names of these files are the same is in previous configurations. The new scripts refer to BAT files that contain the commands using curl.exe to send files using SFTP protocol.
  

Using WinSCP

WinSCP is available for download on the internet:

https://winscp.net/eng/index.php

Disclaimer

Comet Electronics makes no guarantees whatsoever regarding the suitability or security of any third-party software such as WinSCP, PuTTY, or TeraTerm. Use at your own risk. It is up to the user to establish that software is genuine, properly licensed, and compliant with any company Information Technology (IT) policies. Contact your IT department for guidance.

WinSCP provides a graphical interface showing files on your PC and files on the remote system. Refer to WinSCP website for documentation. When uploading files to the APU102, ensure that /d/aei is the current directory (see illustration).

To connect with an APU102, you will need to know which protocols are supported: SCP, FTP, or both. Note: is it possible for an APU102 to be configured such that neither transfer protocol is supported.

Authentication

When connecting to an SFTP server, the APU102 (the client) is required to provide a username and either a password or private key.

If a key is to be used, the private key is installed on the APU102 and specified in the BAT file.

The corresponding public key is installed on the server in the “authorized_keys” file. This is server-specific (e.g. OpenSSH configuration may not be the same as other server software).

Sample BAT File

A sample BAT file is shown:

REM 1 - site index

REM 2 - filename

REM 3 - site name

set OUTPUT=MYRR2CN.%1.TXT

set OUTPUT2=MYRR 2CN.2.%1.TXT

set OUTLOG=MYRR 2CN.%1.LOG

del %OUTPUT%

del %OUTPUT2%

del %OUTLOG%

REM be sure to keep the trailing '/' on the URL if specifying a directory!

curl -k -u someuser:somepassword -T %2 sftp://10.1.3.200/MYRR_TO_CNRR/ 1> %OUTPUT% 2> %OUTPUT2%

REM check error level

if NOT %ERRORLEVEL% == 0 goto Failure

REM create log file

:Success

echo Status:success > %OUTLOG%

echo Supporting info: >> %OUTLOG%

echo curl completed successfully >> %OUTLOG%

goto End

:Failure

:CurlFailure

echo Status:failure > %OUTLOG%

echo Supporting info: >> %OUTLOG%

strfunc -sf "curl:" %OUTPUT2%

if %ERRORLEVEL% == 1 goto UnknownFailure

strfunc -sf "curl:" %OUTPUT2% >> %OUTLOG%

goto End

:UnknownFailure

echo Status:failure > %OUTLOG%

echo Supporting info: >> %OUTLOG%

echo Curl had unexpected failure, check log file >> %OUTLOG%

:End

The name of the BAT file must agree with the name of the ACC file. In other words, if the ACC file is called AEICRR1.ACC, the corresponding BAT file must be called AEICRR1.BAT. By convention, the log files (specified in the three set statements at the top of the BAT file have the same base filename (e.g.  AEICRR1) as the ACC file.

If a key file is used in place of a password, the “curl” command should look like this:

curl -k –key keyfilename.key -T %2 sftp://username@10.1.3.200/MYRR_TO_CNRR/ 1> %OUTPUT% 2> %OUTPUT2%

Converting PuTTY Key to OpenSSH

If a public-private key pair is creating using PuTTY, the private key file must be converted to a format usable to OpenSSH before installing on the APU102.

Figure 1

PuTTY includes a utility called PuTTYgen to perform this function. This utility may be found in the PuTTY folder in the Windows Start menu (Figure 1).

The procedure may be used to convert a previously created private key file (.PPK).

Procedure

Figure 2

After starting the PuTTYgen utility, load the private key (.PPK) file by clicking the “Load” button (Figure 2).

Once the file is loaded, select “Export OpenSSH Key” from the Conversions menu (Figure 3):

Figure 3

Figure 4

If prompted to save the key without a passphrase, click “Yes” (Figure 4).

Once the file is saved, it is uploaded to the APU102. The BAT file on the APU102 used to send reports using SFTP need to be edited to specify the appropriate key file (see provided Sample BAT File).

 

 

Open Source Licenses

CURL.EXE

COPYRIGHT AND PERMISSION NOTICE

Copyright (c) 1996 - 2010, Daniel Stenberg, <daniel@haxx.se>.

All rights reserved.

Permission to use, copy, modify, and distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Except as contained in this notice, the name of a copyright holder shall not be used in advertising or otherwise to promote the sale, use or other dealings in this Software without prior written authorization of the copyright holder.