DataFlex

SSH Authenticate with Secure Strings

Demonstrates SSH password authentication using SecureString objects, with the credentials read from an encrypted JSON config file and decrypted directly into secure strings rather than being hard-coded in source.

Background: This shows the shape of a genuinely careful credential flow: secrets live outside the source in encrypted form, and are decrypted straight into a SecureString so a plaintext copy never sits in an ordinary string. A SecureString keeps the value encrypted in memory under a randomly generated session key. In production the decryption key itself would come from a secure source — a key vault, an OS keystore, or the environment — rather than being a literal as shown here for illustration.

Chilkat DataFlex Downloads

Download Chilkat for DataFlex

DataFlex

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoJson
    Handle hoCrypt
    Variant vSsLogin
    Handle hoSsLogin
    Variant vSsPassword
    Handle hoSsPassword
    Handle hoSsh
    Integer iPort
    String sTemp1

    Move False To iSuccess

    //  This example requires the Chilkat API to have been previously unlocked.
    //  See Global Unlock Sample for sample code.

    //  Demonstrates SSH password authentication using SecureString objects, with the credentials
    //  read from an encrypted config file rather than hard-coded in source.

    //  Imagine the login and password were previously encrypted and saved in a JSON config file:
    //  {
    //    "ssh_login": "2+qylFfC56Ck7OQQt/U2/w==",
    //    "ssh_password": "5neIq9Jmn0E3p71N6Yc8TA=="
    //  }
    Get Create (RefClass(cComChilkatJsonObject)) To hoJson
    If (Not(IsComObjectCreated(hoJson))) Begin
        Send CreateComObject of hoJson
    End
    Get ComLoadFile Of hoJson "qa_data/passwords/ssh.json" To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoJson To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  These are the encryption settings used when the credentials were encrypted.  In a real
    //  application the key would come from a secure source, not a literal.
    Get Create (RefClass(cComChilkatCrypt2)) To hoCrypt
    If (Not(IsComObjectCreated(hoCrypt))) Begin
        Send CreateComObject of hoCrypt
    End
    Set ComCryptAlgorithm Of hoCrypt To "aes"
    Set ComCipherMode Of hoCrypt To "cbc"
    Set ComKeyLength Of hoCrypt To 128
    Send ComSetEncodedKey To hoCrypt "000102030405060708090A0B0C0D0E0F" "hex"
    Send ComSetEncodedIV To hoCrypt "000102030405060708090A0B0C0D0E0F" "hex"
    Set ComEncodingMode Of hoCrypt To "base64"

    //  Decrypt directly into SecureString objects.  The values remain encrypted in memory, now
    //  under a randomly generated session key.
    Get Create (RefClass(cComChilkatSecureString)) To hoSsLogin
    If (Not(IsComObjectCreated(hoSsLogin))) Begin
        Send CreateComObject of hoSsLogin
    End
    Get Create (RefClass(cComChilkatSecureString)) To hoSsPassword
    If (Not(IsComObjectCreated(hoSsPassword))) Begin
        Send CreateComObject of hoSsPassword
    End
    Get ComStringOf Of hoJson "ssh_login" To sTemp1
    Get pvComObject of hoSsLogin to vSsLogin
    Get ComDecryptSecureENC Of hoCrypt sTemp1 vSsLogin To iSuccess
    Get ComStringOf Of hoJson "ssh_password" To sTemp1
    Get pvComObject of hoSsPassword to vSsPassword
    Get ComDecryptSecureENC Of hoCrypt sTemp1 vSsPassword To iSuccess

    Get Create (RefClass(cComChilkatSsh)) To hoSsh
    If (Not(IsComObjectCreated(hoSsh))) Begin
        Send CreateComObject of hoSsh
    End
    Move 22 To iPort
    Get ComConnect Of hoSsh "ssh.example.com" iPort To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  Authenticate using the secure strings.
    Get pvComObject of hoSsLogin to vSsLogin
    Get pvComObject of hoSsPassword to vSsPassword
    Get ComAuthenticateSecPw Of hoSsh vSsLogin vSsPassword To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Showln "SSH authentication successful."

    Send ComDisconnect To hoSsh


End_Procedure