Pascal (Lazarus/Delphi)

SFTP Set Allowed Algorithms

See more SFTP Examples

Demonstrates how to explicitly set the algorithms allowed in the SSH connection protocol for SFTP.

Note: This example requires Chilkat v9.5.0.99 or greater.

Pascal (Lazarus/Delphi)

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.SFtp,
  Chilkat.JsonObject;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  sftp: TSFtp;
  json: TJsonObject;
  allowed_kex: string;
  allowed_hostKey: string;
  allowed_cipher: string;
  allowed_mac: string;
  port: Integer;

begin
  success := False;

  //  This example requires the Chilkat API to have been previously unlocked.
  //  See Global Unlock Sample for sample code.

  sftp := TSFtp.Create;

  json := TJsonObject.Create;

  //  Here are the algorithms supported by Chilkat at the time this example was written (14-June-2024)

  //  ---------------------------
  //  SSH Key-Exchange Algorithms
  //  ---------------------------
  //  curve25519-sha256
  //  curve25519-sha256@libssh.org
  //  ecdh-sha2-nistp256
  //  ecdh-sha2-nistp384
  //  ecdh-sha2-nistp521
  //  diffie-hellman-group14-sha256
  //  diffie-hellman-group16-sha512
  //  diffie-hellman-group18-sha512
  //  diffie-hellman-group-exchange-sha256
  //  diffie-hellman-group1-sha1
  //  diffie-hellman-group14-sha1
  //  diffie-hellman-group-exchange-sha1

  //  ---------------------------
  //  SSH Host Key Algorithms
  //  ---------------------------
  //  ssh-ed25519
  //  ecdsa-sha2-nistp256
  //  ecdsa-sha2-nistp384
  //  ecdsa-sha2-nistp521
  //  rsa-sha2-256
  //  rsa-sha2-512
  //  ssh-rsa
  //  ssh-dss

  //  ---------------------------
  //  SSH Cipher Algorithms
  //  ---------------------------
  //  chacha20-poly1305@openssh.com
  //  aes128-ctr
  //  aes256-ctr
  //  aes192-ctr
  //  aes128-cbc
  //  aes256-cbc
  //  aes192-cbc
  //  aes128-gcm@openssh.com
  //  aes256-gcm@openssh.com
  //  twofish256-cbc
  //  twofish128-cbc
  //  blowfish-cbc

  //  ---------------------------
  //  SSH MAC Algorithms
  //  ---------------------------
  //  hmac-sha2-256
  //  hmac-sha2-512
  //  hmac-sha2-256-etm@openssh.com
  //  hmac-sha2-512-etm@openssh.com
  //  hmac-sha1-etm@openssh.com
  //  hmac-sha1
  //  hmac-ripemd160
  //  hmac-sha1-96
  //  hmac-md5

  //  Specify the allowed key-exchange, host-key, cipher (i.e. encryption), and mac (i.e. hash) algorithms allowed, in the order of preference.
  //  -------------------------------------------------------------------------------------------------------------------------------------------
  //  Note: You typically should NOT explicitly set allowed algorithms.
  //  By default, Chilkat orders algorithms according to best practices, and pays attention to vulnerabilities such as the "Terrapin Attack".
  //  Hard-coding algorthims can make your application brittle and prone to breaking over a long period of time,
  //  if a server (at some point in the future) changes its allowed algorithms, or if you connect to a different server,
  //  such that the client (Chilkat) and server cannot find a set of mutually agreed-upon algorithms.
  //  -------------------------------------------------------------------------------------------------------------------------------------------
  allowed_kex := 'curve25519-sha256@libssh.org,ecdh-sha2-nistp256';
  allowed_hostKey := 'ssh-ed25519,ecdsa-sha2-nistp256';
  allowed_cipher := 'chacha20-poly1305@openssh.com,aes256-ctr';
  allowed_mac := 'hmac-sha2-256,hmac-sha2-512';

  json.UpdateString('kex',allowed_kex);
  json.UpdateString('hostKey',allowed_hostKey);
  json.UpdateString('cipher',allowed_cipher);
  json.UpdateString('mac',allowed_mac);
  sftp.SetAllowedAlgorithms(json);

  port := 22;
  success := sftp.Connect('example.com',port);
  if (success <> True) then
    begin
      WriteLn(sftp.LastErrorText);
      Exit;
    end;

  WriteLn('Connected.');

  //  ....
  //  ....


  sftp.Free;
  json.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.