SFTP Set Allowed SSH Algorithms

See more SFTP Examples

Demonstrates the Chilkat SFtp.SetAllowedAlgorithms method, which configures the exact set of SSH algorithms permitted for the connection. A JsonObject supplies comma-separated allow-lists for the kex, hostKey, cipher, and mac categories. It must be called before Connect.

Important: You typically should not set allowed algorithms explicitly. By default Chilkat orders algorithms according to best practices and accounts for known vulnerabilities.

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.SFtp,
  Chilkat.JsonObject;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  sftp: TSFtp;
  json: TJsonObject;
  allowed_kex: string;
  allowed_hostKey: string;
  allowed_cipher: string;
  allowed_mac: string;
  port: Integer;

begin
  success := False;

  //  Demonstrates the SFtp.SetAllowedAlgorithms method, which configures the exact set of SSH
  //  algorithms permitted for the connection.  The only argument is a JsonObject.  It must be
  //  called before Connect.
  //  
  //  -------------------------------------------------------------------------------------------
  //  Note: You typically should NOT explicitly set allowed algorithms.
  //  By default, Chilkat orders algorithms according to best practices and accounts for known
  //  vulnerabilities such as the "Terrapin Attack".  Hard-coding algorithms can make an
  //  application brittle over time: if a server later changes its allowed algorithms, or if you
  //  connect to a different server, the client and server may fail to agree on a mutually
  //  supported set.
  //  -------------------------------------------------------------------------------------------

  sftp := TSFtp.Create;

  json := TJsonObject.Create;

  //  The algorithms supported by Chilkat, by category:
  //  
  //  Key-exchange:
  //    curve25519-sha256
  //    curve25519-sha256@libssh.org
  //    ecdh-sha2-nistp256
  //    ecdh-sha2-nistp384
  //    ecdh-sha2-nistp521
  //    diffie-hellman-group14-sha256
  //    diffie-hellman-group16-sha512
  //    diffie-hellman-group18-sha512
  //    diffie-hellman-group-exchange-sha256
  //    diffie-hellman-group1-sha1
  //    diffie-hellman-group14-sha1
  //    diffie-hellman-group-exchange-sha1
  //  
  //  Host key:
  //    ssh-ed25519
  //    ecdsa-sha2-nistp256
  //    ecdsa-sha2-nistp384
  //    ecdsa-sha2-nistp521
  //    rsa-sha2-256
  //    rsa-sha2-512
  //    ssh-rsa
  //    ssh-dss
  //  
  //  Cipher (encryption):
  //    chacha20-poly1305@openssh.com
  //    aes128-ctr
  //    aes256-ctr
  //    aes192-ctr
  //    aes128-cbc
  //    aes256-cbc
  //    aes192-cbc
  //    aes128-gcm@openssh.com
  //    aes256-gcm@openssh.com
  //    twofish256-cbc
  //    twofish128-cbc
  //    blowfish-cbc
  //  
  //  MAC (hash):
  //    hmac-sha2-256
  //    hmac-sha2-512
  //    hmac-sha2-256-etm@openssh.com
  //    hmac-sha2-512-etm@openssh.com
  //    hmac-sha1-etm@openssh.com
  //    hmac-sha1
  //    hmac-ripemd160
  //    hmac-sha1-96
  //    hmac-md5

  //  List the allowed key-exchange, host-key, cipher (encryption), and mac (hash) algorithms, in
  //  order of preference.
  allowed_kex := 'curve25519-sha256@libssh.org,ecdh-sha2-nistp256';
  allowed_hostKey := 'ssh-ed25519,ecdsa-sha2-nistp256';
  allowed_cipher := 'chacha20-poly1305@openssh.com,aes256-ctr';
  allowed_mac := 'hmac-sha2-256,hmac-sha2-512';

  json.UpdateString('kex',allowed_kex);
  json.UpdateString('hostKey',allowed_hostKey);
  json.UpdateString('cipher',allowed_cipher);
  json.UpdateString('mac',allowed_mac);

  //  Apply the allow-list before connecting.
  success := sftp.SetAllowedAlgorithms(json);
  if (success = False) then
    begin
      WriteLn(sftp.LastErrorText);
      Exit;
    end;

  port := 22;
  success := sftp.Connect('sftp.example.com',port);
  if (success = False) then
    begin
      WriteLn(sftp.LastErrorText);
      Exit;
    end;
  WriteLn('Connected.');

  sftp.Disconnect();


  sftp.Free;
  json.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.