VS Code instead of RDi: Code for IBM i from day one

Code for IBM i is the VS Code extension that opens source members, compiles, and shows errors on the line. It connects to the system over SSH, and installs nothing on the system: you need the SSH server running, a profile with a password and, for everything to work, the bash shell. The extension's documentation declares IBM i 7.4 and later as supported; 7.3 may work, but is not supported.

What changes compared with SEU and RDi is told in the chapter The tools people work with today. This is how to start.

On the system: the administrator's job

The SSH server

The SSH server is in licensed program 5733-SC1 (OpenSSH, OpenSSL, zlib). Start it with:

STRTCPSVR SERVER(*SSHD)

The QSSHD profile must be enabled. To have it start every time TCP/IP starts, IBM gives three equivalent routes; the most direct is in IBM Navigator for i: Network > TCP/IP Configuration > Properties > Servers to Start, and tick SSHD.

The shell

When a user signs on over SSH, OpenSSH starts the shell set in their profile; if there is none, it uses /QOpenSys/usr/bin/bsh. With bsh several extension features do not work, and the documentation asks for bash, which comes with the IBM i open source tools (/QOpenSys/pkgs/bin/bash). Set it with an SQL procedure:

-- for your own profile
CALL QSYS2.SET_PASE_SHELL_INFO('*CURRENT', '/QOpenSys/pkgs/bin/bash');

-- for every profile that has none (needs *SECADM)
CALL QSYS2.SET_PASE_SHELL_INFO('*DEFAULT', '/QOpenSys/pkgs/bin/bash');

*DEFAULT does not apply to IBM-supplied profiles. If bash is not installed, which bash from an SSH session returns nothing, and it has to be installed first.

The CCSID

A profile with CCSID 65535, meaning "no conversion", makes object and member names unreadable in the extension. The profile needs the CCSID of its language, written in the profile or taken from the QCCSID system value with CCSID(*SYSVAL).

On the PC

1. VS Code, from Microsoft.
2. From the extensions: Code for IBM i (HalcyonTechLtd.code-for-ibmi) and, recommended, the IBM i Development Pack, which bundles the extensions built on top of it.
3. In the IBM i icon on the left: Connect to an IBM i. Enter address, port, profile, and the password or a private key. If the system has MFA, tick the matching option and the TOTP code is asked at every connection.

On the first connection the extension checks the shell and, if it is not bash, offers to change it.

An example: connecting to PUB400

On the public, free IBM i, SSH answers on port 2222, not 22. The connection looks like this:

Then, in the User Library List view, add one of the two libraries you received; in the object browser create a filter on that library, open the member and compile with Ctrl+E (Cmd+E on a Mac). With OPTION(*EVENTF) the errors show up in the Problems tab, on the line that produced them.

First-day problems

SSH keys and MFA are not enough to make the system safe. A profile that comes in over SSH has the same authorities it has in 5250, on every object it can reach. Whoever enables SSH for developers should know which profiles use it, and that is what the audit journal is for, as explained in Turning on the audit journal and reading it with SQL.

Which versions this works on

Code for IBM i declares IBM i 7.4 and later as supported. SET_PASE_SHELL_INFO is in IBM's documentation from 7.3. The SSH server is in licensed program 5733-SC1.

Sources

• Start TCP/IP Server (STRTCPSVR) — IBM Documentation 7.5, *SSHD
• How to setup the IBM i SSH daemon to autostart with TCP/IP — IBM Support
• SET_PASE_SHELL_INFO procedure — IBM Documentation 7.5
• OpenSSH, OpenSSL, zlib (5733-SC1) — IBM Documentation 7.5