Visual FoxPro

SSH Tunnel Set Allowed SSH Algorithms

Demonstrates the Chilkat SshTunnel.SetAllowedAlgorithms method, which restricts the SSH connection to a specific set of algorithms. A JsonObject supplies comma-separated allow-lists for the kex, hostKey, cipher, and mac categories. It must be called before Connect.

Important: You typically should not set allowed algorithms explicitly. By default Chilkat orders algorithms according to best practices and accounts for known vulnerabilities.

Background: SSH negotiates a mutually supported algorithm from each category at connection time, and pinning that choice makes an application brittle: if the server later drops a weak algorithm, the two sides may fail to agree and the tunnel stops working. The legitimate reasons to override are a security policy mandating specific algorithms or a compatibility problem with an old server; otherwise let the library's defaults evolve with current guidance.

Chilkat Visual FoxPro Downloads

Download Chilkat for Visual FoxPro

Visual FoxPro

LOCAL lnSuccess
LOCAL loTunnel
LOCAL loJson
LOCAL lnSshPort
LOCAL lnWaitForThreadExit

lnSuccess = 0

*  Demonstrates the SshTunnel.SetAllowedAlgorithms method, which restricts the SSH connection to a
*  specific set of algorithms.  The only argument is a JsonObject.  It must be called before
*  Connect.
*  
*  Note: You typically should NOT set allowed algorithms explicitly.  By default Chilkat orders
*  algorithms according to best practices and accounts for known vulnerabilities.  Hard-coding
*  them can make an application brittle if a server later changes its allowed algorithms.

loTunnel = CreateObject('Chilkat.SshTunnel')

*  List the allowed algorithms for each category, in order of preference.
loJson = CreateObject('Chilkat.JsonObject')
loJson.UpdateString("kex","curve25519-sha256@libssh.org,ecdh-sha2-nistp256")
loJson.UpdateString("hostKey","ssh-ed25519,ecdsa-sha2-nistp256")
loJson.UpdateString("cipher","chacha20-poly1305@openssh.com,aes256-ctr")
loJson.UpdateString("mac","hmac-sha2-256,hmac-sha2-512")

*  Apply the allow-list before connecting.
lnSuccess = loTunnel.SetAllowedAlgorithms(loJson)
IF (lnSuccess = 0) THEN
    ? loTunnel.LastErrorText
    RELEASE loTunnel
    RELEASE loJson
    CANCEL
ENDIF

loTunnel.DestHostname = "db.internal.example.com"
loTunnel.DestPort = 5432

lnSshPort = 22
lnSuccess = loTunnel.Connect("ssh.example.com",lnSshPort)
IF (lnSuccess = 0) THEN
    ? loTunnel.LastErrorText
    RELEASE loTunnel
    RELEASE loJson
    CANCEL
ENDIF

? "Connected."

lnWaitForThreadExit = 1
lnSuccess = loTunnel.CloseTunnel(lnWaitForThreadExit)
IF (lnSuccess = 0) THEN
    ? loTunnel.LastErrorText
    RELEASE loTunnel
    RELEASE loJson
    CANCEL
ENDIF

RELEASE loTunnel
RELEASE loJson