Pascal (Lazarus/Delphi)

SSH Authenticate with Secure Strings

Demonstrates SSH password authentication using SecureString objects, with the credentials read from an encrypted JSON config file and decrypted directly into secure strings rather than being hard-coded in source.

Background: This shows the shape of a genuinely careful credential flow: secrets live outside the source in encrypted form, and are decrypted straight into a SecureString so a plaintext copy never sits in an ordinary string. A SecureString keeps the value encrypted in memory under a randomly generated session key. In production the decryption key itself would come from a secure source — a key vault, an OS keystore, or the environment — rather than being a literal as shown here for illustration.

Chilkat Pascal (Lazarus/Delphi) Downloads

Download Chilkat for Pascal (Lazarus/Delphi)

Pascal (Lazarus/Delphi)

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.Ssh,
  Chilkat.SecureString,
  Chilkat.JsonObject,
  Chilkat.Crypt2;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  json: TJsonObject;
  crypt: TCrypt2;
  ssLogin: TSecureString;
  ssPassword: TSecureString;
  ssh: TSsh;
  port: Integer;

begin
  success := False;

  //  This example requires the Chilkat API to have been previously unlocked.
  //  See Global Unlock Sample for sample code.

  //  Demonstrates SSH password authentication using SecureString objects, with the credentials
  //  read from an encrypted config file rather than hard-coded in source.

  //  Imagine the login and password were previously encrypted and saved in a JSON config file:
  //  {
  //    "ssh_login": "2+qylFfC56Ck7OQQt/U2/w==",
  //    "ssh_password": "5neIq9Jmn0E3p71N6Yc8TA=="
  //  }
  json := TJsonObject.Create;
  success := json.LoadFile('qa_data/passwords/ssh.json');
  if (success = False) then
    begin
      WriteLn(json.LastErrorText);
      Exit;
    end;

  //  These are the encryption settings used when the credentials were encrypted.  In a real
  //  application the key would come from a secure source, not a literal.
  crypt := TCrypt2.Create;
  crypt.CryptAlgorithm := 'aes';
  crypt.CipherMode := 'cbc';
  crypt.KeyLength := 128;
  crypt.SetEncodedKey('000102030405060708090A0B0C0D0E0F','hex');
  crypt.SetEncodedIV('000102030405060708090A0B0C0D0E0F','hex');
  crypt.EncodingMode := 'base64';

  //  Decrypt directly into SecureString objects.  The values remain encrypted in memory, now
  //  under a randomly generated session key.
  ssLogin := TSecureString.Create;
  ssPassword := TSecureString.Create;
  crypt.DecryptSecureENC(json.StringOf('ssh_login'),ssLogin);
  crypt.DecryptSecureENC(json.StringOf('ssh_password'),ssPassword);

  ssh := TSsh.Create;
  port := 22;
  success := ssh.Connect('ssh.example.com',port);
  if (success = False) then
    begin
      WriteLn(ssh.LastErrorText);
      Exit;
    end;

  //  Authenticate using the secure strings.
  success := ssh.AuthenticateSecPw(ssLogin,ssPassword);
  if (success = False) then
    begin
      WriteLn(ssh.LastErrorText);
      Exit;
    end;

  WriteLn('SSH authentication successful.');

  ssh.Disconnect();


  json.Free;
  crypt.Free;
  ssLogin.Free;
  ssPassword.Free;
  ssh.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.