DataFlex

SSH Tunnel Authenticate with Secure Strings

Demonstrates SSH tunnel password authentication using SecureString objects, with the credentials read from an encrypted JSON config file and decrypted directly into secure strings rather than being hard-coded in source.

Background: The SshTunnel class runs the tunnel on a background thread, so it authenticates once and then serves connections until closed — which makes protecting the stored credential especially worthwhile. Decrypting straight into a SecureString avoids ever holding the password in an ordinary string, and the value stays encrypted in memory under a randomly generated session key. In production the decryption key itself would come from a key vault or OS keystore rather than a literal.

Chilkat DataFlex Downloads

Download Chilkat for DataFlex

DataFlex

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoJson
    Handle hoCrypt
    Variant vSsLogin
    Handle hoSsLogin
    Variant vSsPassword
    Handle hoSsPassword
    Handle hoTunnel
    Integer iPort
    Boolean iWaitForThreadExit
    String sTemp1

    Move False To iSuccess

    //  This example requires the Chilkat API to have been previously unlocked.
    //  See Global Unlock Sample for sample code.

    //  Demonstrates SSH tunnel password authentication using SecureString objects, with the
    //  credentials read from an encrypted config file rather than hard-coded in source.

    //  Imagine the login and password were previously encrypted and saved in a JSON config file:
    //  {
    //    "ssh_login": "2+qylFfC56Ck7OQQt/U2/w==",
    //    "ssh_password": "5neIq9Jmn0E3p71N6Yc8TA=="
    //  }
    Get Create (RefClass(cComChilkatJsonObject)) To hoJson
    If (Not(IsComObjectCreated(hoJson))) Begin
        Send CreateComObject of hoJson
    End
    Get ComLoadFile Of hoJson "qa_data/passwords/ssh.json" To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoJson To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  These are the encryption settings used when the credentials were encrypted.  In a real
    //  application the key would come from a secure source, not a literal.
    Get Create (RefClass(cComChilkatCrypt2)) To hoCrypt
    If (Not(IsComObjectCreated(hoCrypt))) Begin
        Send CreateComObject of hoCrypt
    End
    Set ComCryptAlgorithm Of hoCrypt To "aes"
    Set ComCipherMode Of hoCrypt To "cbc"
    Set ComKeyLength Of hoCrypt To 128
    Send ComSetEncodedKey To hoCrypt "000102030405060708090A0B0C0D0E0F" "hex"
    Send ComSetEncodedIV To hoCrypt "000102030405060708090A0B0C0D0E0F" "hex"
    Set ComEncodingMode Of hoCrypt To "base64"

    //  Decrypt directly into SecureString objects.  The values stay encrypted in memory, now under
    //  a randomly generated session key.
    Get Create (RefClass(cComChilkatSecureString)) To hoSsLogin
    If (Not(IsComObjectCreated(hoSsLogin))) Begin
        Send CreateComObject of hoSsLogin
    End
    Get Create (RefClass(cComChilkatSecureString)) To hoSsPassword
    If (Not(IsComObjectCreated(hoSsPassword))) Begin
        Send CreateComObject of hoSsPassword
    End
    Get ComStringOf Of hoJson "ssh_login" To sTemp1
    Get pvComObject of hoSsLogin to vSsLogin
    Get ComDecryptSecureENC Of hoCrypt sTemp1 vSsLogin To iSuccess
    Get ComStringOf Of hoJson "ssh_password" To sTemp1
    Get pvComObject of hoSsPassword to vSsPassword
    Get ComDecryptSecureENC Of hoCrypt sTemp1 vSsPassword To iSuccess

    Get Create (RefClass(cComChilkatSshTunnel)) To hoTunnel
    If (Not(IsComObjectCreated(hoTunnel))) Begin
        Send CreateComObject of hoTunnel
    End

    Move 22 To iPort
    Get ComConnect Of hoTunnel "ssh.example.com" iPort To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoTunnel To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  Authenticate using the secure strings.
    Get pvComObject of hoSsLogin to vSsLogin
    Get pvComObject of hoSsPassword to vSsPassword
    Get ComAuthenticateSecPw Of hoTunnel vSsLogin vSsPassword To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoTunnel To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Showln "SSH tunnel authentication successful."

    //  ... use the tunnel ...

    Move True To iWaitForThreadExit
    Get ComCloseTunnel Of hoTunnel iWaitForThreadExit To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoTunnel To sTemp1
        Showln sTemp1
        Procedure_Return
    End



End_Procedure