Require client authentication for the File Transfer Protocol server

If you need the File Transfer Protocol (FTP) server to authenticate clients, you can change the application specifications in IBM^® Digital Certificate Manager (DCM). This step is optional.

Note: With the FTP server you can authenticate clients, but you cannot do so with the i5/OS™ FTP client. You can require client authentication, but it will exclude connections that are for i5/OS FTP clients.

If an FTP client connects and client authentication is enabled for the server, the client must still send a USER subcommand. After the USER subcommand information is sent, the FTP server will check that the user matches the profile associated with the client certificate that the client sent to the server as part of the SSL handshake. If the user matches the client certificate, no password is needed and the FTP server will log the user onto the system. The USER subcommand is needed because there is no mechanism in the FTP protocol to "inform" the client that it's logged on without the command.

Start IBM Digital Certificate Manager. If you need to obtain or create certificates, or otherwise setup or change your certificate system, do so now. See Configure DCM for information about setting up a certificate system.
Click the Select a Certificate Store button.
Select *SYSTEM. Click Continue.
Enter the appropriate password for *SYSTEM certificate store. Click Continue.
When the left navigational menu reloads, expand Manage Applications.
Click Update application definition.
On the next screen, select Server application. Click Continue.
Click i5/OS TCP/IP FTP Server.
Click Update Application Definition.
In the table that displays, select Yes to require client authentication.
Click Apply.
DCM reloads to the Update Application Definition page with a confirmation message. When you are finished updating the application definition for the FTP server, click Done.