# FTP, FTPS and SFTP for z/OS and IBM i | WND Software Docs Source: https://wndsoftware.com/docs/file-transfer ### File transfer (FTP, FTPS and SFTP) A file transfer client built into WND Terminal, for moving files between people’s computers and a mainframe, an IBM i or any other host. Press Ctrl+K and choose File transfer (FTP, FTPS, SFTP) . Your computer’s folders are on the left and the host’s on the right. It knows z/OS data sets, PDS members and JES jobs, and IBM i libraries, members and save files. It works in the desktop app and in a browser, and every transfer is in the audit log. On a small screen, swipe the table to read all columns. | Protocol | Port | What it is | | --- | --- | --- | | FTPS | 21 | FTP encrypted with TLS, started with `AUTH TLS`. The usual choice for z/OS and IBM i. | | FTPS, implicit | 990 | FTP encrypted with TLS from the first byte | | SFTP | 22 | File transfer over SSH | | FTP | 21 | Not encrypted. Offered only when your organization allows it. | The client is separate from IND$FILE, which moves files inside a 3270 session. It’s for the jobs people used Reflection FTP, BlueZone Secure FTP or PCOMM’s FTP client for. ### Open it Press Ctrl+K and choose File transfer (FTP, FTPS, SFTP) . From a session, File transfer with starts a site for that session’s host, as z/OS for a mainframe session and IBM i for a 5250 one. A site is a host and how to reach it, with the protocol, port, user ID, host type and the folder to start in. An SFTP site can also have a key file. Saved sites are listed on the left. The password is never saved. It’s asked for each time and kept in memory only while the site is open. Connections go through the same proxy as sessions. ### Is it the right host? FTPS checks the host’s certificate exactly as encrypted sessions do, and each data connection must show the same certificate as the control connection. SFTP checks the host’s SSH key. A new host’s fingerprint is shown to check and trust. A host whose key has changed is refused, with both fingerprints, and there’s no button past it. UNIX and Linux sessions over SSH use the same known hosts list. Keys IT lists in `TrustedHostKeys` or `SSHKnownHosts` are accepted without asking. ### Move files This computer’s folders are on the left and the host’s are on the right. Select files and use Send or Receive , double-click a file, or drag files from one side to the other or from your own file manager. Each side has New folder, Rename and Delete, and Delete asks first. - Automatic sends text files as text and the rest as binary. Load modules and IBM i save files always go as binary. - Text lets the host convert EBCDIC and records to lines with this computer’s line ends. - Binary moves the bytes as they are. - EBCDIC keeps z/OS records in EBCDIC, with no conversion. The transfer list shows each file waiting, moving and done, or why not. When a file is already there, you choose Replace, Resume (binary transfers, when the copy there is shorter) or Skip, for one file or all of them. ### z/OS data sets and JES The host’s side lists data sets under a prefix with their volume, record format, record length, block size and organization. A PDS or PDSE opens like a folder and shows its members with their ISPF statistics. Type `user1.jcl` or `'USER1.JCL'`, or a z/OS UNIX path such as `/u/user1`. A file sent into a prefix becomes a data set named after it, and into a PDS a member. New data sets sets the record format, record length, block size and space for new data sets. The Jobs tab works with JES through FTP. - Show jobs lists your jobs, or those matching a name and owner, with their status and result, such as `RC=0000` or `ABEND=S0C4`. - Submit JCL sends a JCL file from this computer, and Submit as a job submits a data set or member as it is on the host. The new job’s ID is shown. - Output shows all of a job’s spool files, and Save keeps them as a text file. - Purge deletes a job and its output, after asking. ### IBM i libraries and save files Libraries, source files and members show as folders. The path box takes IBM i names such as `MYLIB`, `MYLIB/QRPGLESRC` and `MYLIB/QRPGLESRC(HELLO)`, and IFS folders such as `/home/USER1`. A file sent into a source file becomes a member named after it. Save files always go as binary, and sending one to a library that doesn’t have it creates it. ### In a browser In [WND Terminal in a browser](https://wndsoftware.com/browser), the gateway makes the connections under its own network rules. The left side is your computer as the browser sees it. Send files picks files, and Download saves the host’s file through the browser, up to 64 MB a file. SFTP key files and active mode aren’t offered there, and only the certificates and host keys your organization trusts are accepted. ### IT settings On a small screen, swipe the table to read all columns. | Setting | Group Policy name | What it does | | --- | --- | --- | | `AllowFileTransfer` | Turn off file transfer | False turns off the client and IND$FILE. | | `AllowFTP`, `AllowFTPS`, `AllowSFTP` | Turn off plain FTP, FTPS or SFTP in the file transfer client | False turns off one protocol. `RequireEncryption` also turns off plain FTP. | | `FileTransferHosts` | Hosts the file transfer client may use | The only hosts allowed, such as `mvs.bank.example` or `*.bank.example`. | | `FileTransferFolders` | Folders files may be sent from and saved to | The only folders on the computer files may come from or go to. | | `AllowFileUpload`, `AllowFileDownload` | Don’t allow sending files to hosts, Don’t allow receiving files from hosts | False stops sending or receiving, in the client, IND$FILE and the automation API. With uploads off, no jobs are submitted. With downloads off, no job output is received. | | `TrustedHostKeys` | Trusted SSH host keys (SFTP) | SSH host keys your organization trusts, as `known_hosts` lines or a host and its fingerprint. | The engine checks these rules before it connects and before each transfer, whatever the interface does. The audit log has each site opened (`ftp.connect`), each file sent or received (`ftp.upload`, `ftp.download`) with its name, size and mode, folders made, files renamed and deleted, host keys trusted, and z/OS jobs submitted, read and purged. Never a password. ### Programs The [automation API](https://wndsoftware.com/docs/automation-api) transfers files with saved sites (`file_list`, `file_get`, `file_put`, `job_submit`, `job_output`). ### What it doesn’t do - TLS session reuse on data connections. A few FTPS servers insist on it, and WND Terminal says so when a host asks. The host’s administrators can turn the requirement off. - Client certificates for FTPS. - Record and block mode transfers and z/OS checkpoint restart. Resume works for binary stream transfers. - Whole folders in one go. Open a folder to send or receive what’s in it. - SSH agent sign-in for SFTP. Use a key file or a password. ### Related [UNIX and Linux sessions SSH sessions share the known hosts list. Read →](https://wndsoftware.com/docs/vt-sessions) [Policy settings Every file transfer setting. Read →](https://wndsoftware.com/docs/policy-settings) [Audit log Send transfers to Splunk or Sentinel. Read →](https://wndsoftware.com/docs/audit-log-splunk-sentinel) ### Questions #### Is this the same as IND$FILE? No. IND$FILE moves files inside a 3270 session, and WND Terminal still does it. The file transfer client connects to the host’s FTP or SSH server, for z/OS, IBM i and any other host. #### Can we stop people using plain FTP? Yes. AllowFTP = false turns it off, and RequireEncryption does too. FTPS and SFTP stay available unless you turn them off. #### Can people submit JCL and read job output? Yes. The Jobs tab submits JCL from the computer or a data set on the host, lists jobs with their results, shows and saves their output, and purges them. Each step is in the audit log. #### Does it work in the browser? Yes. The gateway makes the connections, files come from the browser’s file picker, and downloads arrive through the browser. Technical reviewer: [Albert Joseph](https://wndsoftware.com/authors/albert-joseph), WND Software.