DataFlex

SSH Tunnel Authenticate with a SecureString Password

Demonstrates the Chilkat SshTunnel.AuthenticateSecPw method, which authenticates using SecureString login and password objects. The first argument is the login and the second is the password.

Background: Because a tunnel process is long-lived and holds its SSH credentials for its entire lifetime, protecting them in memory is worthwhile. A SecureString keeps the value encrypted under a randomly generated session key. Populate it from a value obtained at runtime rather than a hard-coded literal.

Chilkat DataFlex Downloads

Download Chilkat for DataFlex

DataFlex

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoTunnel
    Integer iSshPort
    String sPassword
    Variant vSecureLogin
    Handle hoSecureLogin
    Variant vSecurePassword
    Handle hoSecurePassword
    Boolean iWaitForThreadExit
    String sTemp1

    Move False To iSuccess

    //  Demonstrates the SshTunnel.AuthenticateSecPw method, which authenticates using SecureString
    //  login and password objects.  The 1st argument is the login and the 2nd is the password.

    Get Create (RefClass(cComChilkatSshTunnel)) To hoTunnel
    If (Not(IsComObjectCreated(hoTunnel))) Begin
        Send CreateComObject of hoTunnel
    End

    //  The tunnel forwards accepted local connections to this destination through the SSH server.
    Set ComDestHostname Of hoTunnel To "db.internal.example.com"
    Set ComDestPort Of hoTunnel To 5432

    //  Connect to the SSH server.  This performs the TCP/proxy connection and SSH handshake, but
    //  does not authenticate yet.
    Move 22 To iSshPort
    Get ComConnect Of hoTunnel "ssh.example.com" iSshPort To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoTunnel To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  Normally you would not hard-code the password in source.  You should instead obtain it
    //  from an interactive prompt, environment variable, or a secrets vault.
    Move "mySshPassword" To sPassword

    //  Place the login and password into SecureString objects.
    Get Create (RefClass(cComChilkatSecureString)) To hoSecureLogin
    If (Not(IsComObjectCreated(hoSecureLogin))) Begin
        Send CreateComObject of hoSecureLogin
    End
    Get ComAppend Of hoSecureLogin "mySshLogin" To iSuccess
    Get Create (RefClass(cComChilkatSecureString)) To hoSecurePassword
    If (Not(IsComObjectCreated(hoSecurePassword))) Begin
        Send CreateComObject of hoSecurePassword
    End
    Get ComAppend Of hoSecurePassword sPassword To iSuccess

    Get pvComObject of hoSecureLogin to vSecureLogin
    Get pvComObject of hoSecurePassword to vSecurePassword
    Get ComAuthenticateSecPw Of hoTunnel vSecureLogin vSecurePassword To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoTunnel To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Showln "Authenticated with secure strings."

    //  After authenticating, call BeginAccepting to start listening for local connections to forward.

    Move True To iWaitForThreadExit
    Get ComCloseTunnel Of hoTunnel iWaitForThreadExit To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoTunnel To sTemp1
        Showln sTemp1
        Procedure_Return
    End



End_Procedure