Note on usage
Function: Modify partner properties
User group: FT administrator
Functional description
You use the ftmodptn command to modify the properties of partner systems in the local system's partner list.
Please note that if you modify the partner address, it is no longer possible to convert an openFT partner into an FTP partner or FTAM partner or vice versa.
You can remove an entered dynamic partner from the partner list by setting all the properties to the default values for free dynamic partners by means of the ftmodptn
command. The default values are the same as the default values in the ftaddptn command with the exception of the security level setting (option -sl) which must be set to -sl=p.
Similarly, you can add a free dynamic partner to the list by setting at least one of its attributes to a value other than the default. This is possible if partner does not reference a partner list entry and -pa is not specified.
If a partner name for which there is as yet no partner list entry is specified for partner and -pa is also specified then a new named entry is created in the partner list. This function is intended for the re-import of exported partner entries. To explicitly create new partner entries, you should use ftaddptn.
Format
ftmodptn -h |
<partner 1..200> | @a[ -pa=<partner address 1..200> ]
[ -id=<identification 1..64> | -id= ]
[ -ri=<routing info 1..8> | -ri=@i | -ri= ]
[ -ptc=i | -ptc=a | -ptc= ]
[ -pri=l | -pri=n | -pri=h ]
[ -sl=1..100 | -sl=p | -sl= ]
[ -st=a | -st=d | -st=ad ]
[ -ist=a | -ist=d ]
[ -am=n | -am=y ]
[ -rqp=p | -rqp=s ]
[ -rco=n | -rco=f | -rco= ]
[ -tr=n | -tr=f | -tr= ]
[ -nsap=<AFI 36 | .. | 59>.[<IDI 0..15>][.<DSP 0..38>] | 2..40 ]
[ -cl=0/- | -cl=2/0 | -cl=2/2 ]
[ -ws=<1..127> ]
[ -ps=16 | 32 | 64 | 128 | 256 | 512 | 1024 | 2048 | 4096 ]
[ -cud=<2..32> ]
[ -cug=<0..9999> ]
[ -thr=75 | 150 | 300 | 600 | 1200 | 2400 | 4800 | 9600 |
19200 | 48000 | 64000 | 128000 | 192000 ]
[ -rch=y | -rch=n ]
[ -sif=[0][,1][,2][,3]..[,15] ] (Linux systems)
[ -sif=<0..3>:<0..3>[,<0..3>:<0..3>]..[,<0..3>:<0..3>] ] (Windows systems)
[ -kl= | -kl=FTOPT | -kl=0 | 768 | 1024 | 2048 | 3072 | 4096 ]
[ -klmin= | -klmin=FTOPT | -klmin=0 | 768 | 1024 | 2048 | 3072 | 4096 ]
Description
-h
Displays the command syntax on the screen. Entries after the -h are ignored.
partner | @a
partner is the name of the partner system in the partner list or the address of the partner system whose properties you want to modify.
@a for partner
Partner is not a selection criterion, i.e. you modify the properties of all the partner systems present in the partner list. This specification is only possible in combination with the options -ptc, -sl, -st, -ist, -am, -rqp and -tr..
Particular care is necessary when using @a in combination with -sl (security level)!
-pa=partner address
You use -pa to enter the address of the partner system in the following form:
[protocol://]host[:[port].[tsel].[ssel].[psel]]
For details concerning address specifications, see section “Specifying partner addresses”.
-pa not specified
The partner address is unchanged.
-id=identification | -id=
Identification unique in the network of the openFT instance in the partner system. In the case of FTAM partners, it is possible to specify an Application Entity Title in the form n1.n2.n3.n4..mmm as the identification. n1, n2 etc. are positive integer values which describe the "Application Process Title". n1 can only have the values 0, 1 or 2, n2 is restricted to values between 0 and 39 if n1 does not have the value 2. The optional Application Entity Qualifier mmm must be separated from the values of the Application Process Title by two periods. For details, see the openFT manual "Concepts and Functions".
In the case of FTP partners, -id must not be specified!
identification not specified
Specifying -id= with no other specification sets the identification to host (host name) for partner entries with openFT and FTADM protocol. For FTAM partners, the identification is deleted if -id= is entered.
-id not specified
The setting for identification is unchanged.
-ri=routing info | -ri=@i | -ri=
If the partner system can only be accessed via an intermediate instance then you specify the address information to be used for routing by the intermediate instance in routing info.
@i for routing info
The instance identification specified in -id= is used as the routing information.
neither @i nor routing info specified
The specification of -ri= (without parameters) means that the partner system can be accessed directly, i.e. without an intermediate instance.
-ri not specified
The setting for the routing information is unchanged.
-ptc=i | -ptc=a | -ptc=
You can use -ptc to modify the operating parameter setting for sender verification on a partner-specific basis. These settings only affect partners which are connected via the openFT protocol and do not operate with authentication (e.g. partners with openFT
V8.0 or earlier).
i (identification)
Deactivates checking of the transport address. Only the partner's identification is checked. The partner's transport address is also not checked even if extended sender verification is globally active (see the ftmodo command).
a (address)
Activates checking of the transport address. The partner's transport address is checked even if checking of the transport address is globally deactivated (see ftmodo command).
If the transport address under which the partner logs on is not the same as the entry in the partner list then the request is rejected.
neither i nor a specified
-ptc= (without parameters) means that the operating system parameters apply to sender verification.
-ptc not specified
The setting for sender verification is unchanged.
-sl=1..100 | -sl=p | -sl=
You use this option to assign a security level to the specified partner system or to all the partner systems.
A low security level means that the need for protection towards this partner is low, for instance because the partner's identity has been authenticated using cryptographic methods, which means that you can be certain that the partner is genuinely who they claim to be.
A high security level means that the need for protection towards this partner is high, because the identity of the partner has only been determined on the basis of their address, for instance, and that no authentication has been performed using cryptographic methods.
1..100
Assigns a fixed security level to the partner. 1 is the lowest and 100 the highest security level.
All integers 1 through 100 are permitted.
p
Assigns a security level to the partner depending on the partner's attributes, i.e.:
Security level 10 if the partner has been authenticated.
Security level 90 if the partner is known in the transport system and is identified by the name it is known in the transport system.
Security level 100 if the partner has only been identified by its address.
security level not specified
-sl= (without parameters) means that the operating parameter setting for the security level applies (see command ftmodo )
-sl not specified
The setting for the security level is unchanged.
-pri=l | -pri=n | -pri=h
-pri allows you to specify the priority of a partner in respect of processing requests that have the same request priority. This means that the partner priority only applies in the case of requests that have the same request priority, but that are issued to partners with a different partner priority.
l (low)
The partner is assigned a low priority.
n (normal)
The partner is assigned a normal priority.
h (high)
The partner is assigned a high priority.
-pri not specified
The priority setting remains unchanged.
-st=a | -st=d | -st=ad
This option allows you to control how locally submitted asynchronous file transfer requests to the specified partner system or systems are processed.
a (active)
Locally submitted asynchronous file transfer requests are processed if the asynchronous openFT server is started.
d (deactivated)
Locally submitted asynchronous file transfer requests are initially not processed but are stored in the request queue.
ad (automatic deactivation)
Multiple consecutive unsuccessful attempts to establish a connection to this partner system result in its deactivation. If you want to perform file transfer again with this system, you must explicitly activate it with ftmodptn -st=a.
The maximum number of such unsuccessful attempts is 5. After a connection has been established successfully, the counter is reset to 0.
-st not specified
The processing mode is unchanged.
-ist=a | -ist=d
This option allows you to control how file transfer requests issued remotely by the specified partner system or partner systems are processed.
a (active)
File transfer requests issued remotely are processed if the asynchronous openFT server is started.
d (deactivated)
Synchronous file transfer requests issued remotely are rejected. Asynchronous file transfer requests issued remotely by this partner are stored there and cannot be processed until this partner is activated again with -ist=a.
-ist not specified
The processing mode is unchanged.
-am=n | -am=y
You can use -am (authentication mode) to force partner authentication.
n
Authentication is not forced, i.e. this partner is not restricted with regard to authentication.
y
Authentication is forced, i.e. requests are only processed if the local system is successfully able to authenticate the partner.
-am not specified
The authentication mode is unchanged.
-rqp=p | -rqp=s
You use this option (rqp = request processing) to control whether asynchronous outbound requests to this partner are always run serially or whether parallel requests are permitted.
p (parallel)
Parallel connections to this partner are permitted.
s (serial)
Parallel connections to this partner are not permitted. If multiple file transfer requests to this partner are pending then they are processed serially. A follow-up request is not started until the preceding request has terminated.
-rqp not specified
The operating mode is unchanged.
-rco=n | -rco=f | -rco=
With this option (rco = recovery outbound) you can switch on and off the restart function for outbound requests. The parameter has no impact if the implementation of the file transfer protocol (FTP) or the type of request (e.g. preprocessing, synchronous orders) does not permit a restart.
n (on)
the restart is always activated for this partner for outbound requests.
f (off)
the restart is deactivated for this partner for outbound requests.
neither n nor f specified (default value)
-rco= (without parameters) means that the restart operability for outbound requests depends on the setting in the operating parameters, see ftmodo command.
-rco not specified
The setting for the restart function remains unchanged.
-tr=n | -tr=f | -tr=
You can use this option to modify the operating parameter settings for the partner selection for the openFT trace function on a partner-specific basis.
n (on)
The trace function is active for this partner or for all the partners. However, a trace is only written if the openFT trace function has been activated via the operating parameters. In this case, this setting for ftmodptn takes priority over the partner selection for the trace function in the operating parameters. See ftmodo , -tr and -trp options.
f (off)
The trace function is deactivated for this partner or for all partners.
neither n nor f specified
-tr= (without parameters) means that the operating parameter setting for the partner selection in the openFT trace function applies (see the ftmodo command).
-tr not specified
The setting for the trace function is unchanged.
The following options are valid for partners with an X.25 transport address.
If, on a Windows system, the type of partner address (option -pa) is changed for the ftmodptn command to the extent that e.g. an X.25 address becomes a TCP/IP-RFC1006 address, all X.25-specific address parameters will be deleted.
-nsap= network address of the partner system
See description of the parameter for the command ftaddptn .
-nsap=
Deletes the setting for the network address of the partner system.
-cl= transport protocol class
See description of the parameter for the command ftaddptn .
-cl=
Deletes the setting for the transport protocol class.
-ws= window size
See description of the parameter for the command ftaddptn .
-ws=
Deletes the setting for the window size.
-ps= packet size
See description of the parameter for the command ftaddptn .
-ps=
Deletes the setting for the packet size.
-cud= user data for the X.25 connection setup
See description of the parameter for the command ftaddptn .
-cud=
Deletes the setting for the user data.
-cug= closed user group
See description of the parameter for the command ftaddptn .
-cug=
Deletes the setting for the closed user group.
-thr= throughput class
See description of the parameter for the command ftaddptn .
-thr=
Deletes the setting for the throughput class.
-rch= reverse charging
See description of the parameter for the command ftaddptn .
-rch=
Deletes the setting for the reverse charging.
-sif= alternative line (Different for Windows and Linux)
See description of the parameter for the command ftaddptn .
-sif=
Deletes the setting for the alternative line.
-kl= | -kl=FTOPT | -kl=0 | 768 | 1024 | 2048 | 3072 | 4096
The parameter can be used to change the length of the RSA key used in encryption. The value of the kl parameter specifies the new RSA key length (RSA-PROPOSED) in bits. The RSA key is only used for the encryption of the AES key agreed between the partners. The configured key length for RSA proposal must be greater than or equal to the specified minimum key length, otherwise a warning will be issued and the proposed key length will be adapted to the minimum key length.
-kl= | -kl=FTOPT
Empty string or “FTOPT” option specifies, that key value will be taken from global openFT options displayed via “ftshwo” command. Either both of key values (RSA-PROPOSED and RSA-MINIMUM) need to be set to “FTOPT” or none. Combination of one key having global value and second local partner value (0 … 4096) is not allowed, warning will be issued and keys will be adjusted automatically to “FTOPT value.
-kl=0
-kl=0 explicitly deactivates encryption. If this is set during operation, then any requests with encryption (prior to ftmodo -kl=0) that have been submitted but not yet started are aborted with errors. Any running requests are processed, and their encryption is retained. New requests using encryption are rejected.
-kl=768 | 1024 | 2048 | 3072 | 4096
Standard values for RSA-PROPOSAL encryption. Values from 0 to 4096 take priority over the ones specified in global openFT option visible via ftshwo command.
Default setting following update, export from openFT before version 12.1C70 or not specifying value during creation of partner: -kl=FTOPT. Otherwise default value is "UNCHANGED" meaning that it will stay the same after modification as with most modify commands.
When only RSA-PROPOSAL is specified during addition of partner (without specifying RSA-MINIMUM), then both parameters will be set to global FTOPT values.
-klmin= | -klmin=FTOPT | -klmin=0 | 768 | 1024 | 2048 | 3072 | 4096
This option specifies the minimum RSA key length.
-klmin= | -klmin=FTOPT
Empty string or “FTOPT” option specifies, that key value will be taken from global openFT options displayed via “ftshwo” command. Either both of key values (RSA-PROPOSED and RSA-MINIMUM) need to be set to “FTOPT” or none. Combination of one key having global value and second local partner value (0 … 4096) is not allowed, warning will be issued and keys will be adjusted automatically to “FTOPT value.
-klmin=0
No minimum key length is specified. Any key length and even requests without encryption will be accepted.
-klmin=768 | 1024 | 2048 | 3072 | 4096
Standard values for RSA-MINIMUM encryption. Only keys of the specified length or larger ones will be accepted. If the initiator uses a key of a lower length there will be a counter proposal by the responder of the session. Sessions without encryption will not be accepted. That means: Since an RSA key set is always created on the open platforms during installation, an RSA key is always sent in the protocol during the subsequent data transfer. If this key is deleted and the partner requests encryption, then the partner rejects the connection with s Session Reject (SRJ) "connection not accepted without encryption".
Values from 0 to 4096 take priority over the ones specified in global openFT option visible via ftshwo command.
Default setting following update, export from openFT before version 12.1C70 or not specifying value during creation of partner: -kl=FTOPT. Otherwise default value is "UNCHANGED" meaning that it will stay the same after modification as with most modify commands.
When only RSA-MINIMUML is specified during addition of partner (without specifying RSA-PROPOSAL), then both parameters will be set to global FTOPT values.
Example
X.25 partner on a Windows system:
ftmodptn mchx25 -nsap= -ws=2 -ps=128 -thr=192000 -sif=3:0
X.25 partner on a Linux system:
ftmodptn mchx25 -nsap= -ws=2 -ps=128 -thr=192000 -sif=3