Pascal (Lazarus/Delphi)

SSH Host Key Fingerprint

Demonstrates getting the SSH server's host key fingerprint after connecting. The HostKeyFingerprint property returns the classic MD5 form, while GetHostKeyFP returns a fingerprint using a chosen hash algorithm, with optional inclusion of the key type and hash name.

Background: The host key fingerprint identifies the server, and comparing it against a known-good value is how a client implements host-key pinning — detecting a man-in-the-middle or a server whose key has changed. This is the same fingerprint an SSH client shows on first connection when it asks whether to trust the host. Prefer SHA256, which is the modern standard; MD5 fingerprints still appear in older tooling but are cryptographically weak.

Chilkat Pascal (Lazarus/Delphi) Downloads

Download Chilkat for Pascal (Lazarus/Delphi)

Pascal (Lazarus/Delphi)

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.Ssh;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  ssh: TSsh;
  hostname: string;
  port: Integer;
  md5_fingerprint: string;
  includeKeyType: Boolean;
  includeHashName: Boolean;
  sha256_fingerprint: string;

begin
  success := False;

  //  This example requires the Chilkat API to have been previously unlocked.
  //  See Global Unlock Sample for sample code.

  //  Demonstrates getting the SSH server's host key fingerprint after connecting.

  ssh := TSsh.Create;

  hostname := 'ssh.example.com';
  port := 22;
  success := ssh.Connect(hostname,port);
  if (success = False) then
    begin
      WriteLn(ssh.LastErrorText);
      Exit;
    end;

  //  The classic MD5 fingerprint is available as a property.
  md5_fingerprint := ssh.HostKeyFingerprint;
  WriteLn(md5_fingerprint);
  //  For example:  ssh-rsa 3072 21:b0:d8:41:4e:ef:78:10:20:af:01:b7:71:5d:eb:94

  //  GetHostKeyFP returns a fingerprint using the hash algorithm of your choice, such as SHA256,
  //  SHA384, or SHA512.  The 2nd and 3rd arguments control whether the key type and the hash name
  //  are included in the returned string.
  includeKeyType := True;
  includeHashName := True;
  sha256_fingerprint := ssh.GetHostKeyFP('SHA256',includeKeyType,includeHashName);
  if (ssh.LastMethodSuccess = False) then
    begin
      WriteLn(ssh.LastErrorText);
      Exit;
    end;
  WriteLn(sha256_fingerprint);
  //  ssh-rsa SHA256:Ufgj480OsdsCZRjj9sSNM6fpgIcSJ61RsIG8usndUIY=

  includeKeyType := False;
  includeHashName := True;
  sha256_fingerprint := ssh.GetHostKeyFP('SHA256',includeKeyType,includeHashName);
  if (ssh.LastMethodSuccess = False) then
    begin
      WriteLn(ssh.LastErrorText);
      Exit;
    end;
  WriteLn(sha256_fingerprint);
  //  SHA256:Ufgj480OsdsCZRjj9sSNM6fpgIcSJ61RsIG8usndUIY=

  includeKeyType := True;
  includeHashName := False;
  sha256_fingerprint := ssh.GetHostKeyFP('SHA256',includeKeyType,includeHashName);
  if (ssh.LastMethodSuccess = False) then
    begin
      WriteLn(ssh.LastErrorText);
      Exit;
    end;
  WriteLn(sha256_fingerprint);
  //  ssh-rsa Ufgj480OsdsCZRjj9sSNM6fpgIcSJ61RsIG8usndUIY=

  includeKeyType := False;
  includeHashName := False;
  sha256_fingerprint := ssh.GetHostKeyFP('SHA256',includeKeyType,includeHashName);
  if (ssh.LastMethodSuccess = False) then
    begin
      WriteLn(ssh.LastErrorText);
      Exit;
    end;
  WriteLn(sha256_fingerprint);
  //  Ufgj480OsdsCZRjj9sSNM6fpgIcSJ61RsIG8usndUIY=

  ssh.Disconnect();


  ssh.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.