Pascal (Lazarus/Delphi)

SSH Keyboard-Interactive Authentication

Demonstrates keyboard-interactive authentication with an SSH server. StartKeyboardAuth returns XML describing the server's prompts, and ContinueKeyboardAuth submits each response. Authentication is complete when the returned XML contains either a success or an error node.

Background: Keyboard-interactive is SSH's flexible, prompt-driven method: rather than assuming a single password, the server asks one or more questions — a password, a one-time code, a security question — and the client answers each. This is how SSH supports two-factor and other challenge-response schemes. The prompt XML also indicates whether each response should be echoed, so a client knows when to mask input. A server may issue several rounds, so a robust implementation loops until it sees success or error rather than assuming one exchange is enough.

Chilkat Pascal (Lazarus/Delphi) Downloads

Download Chilkat for Pascal (Lazarus/Delphi)

Pascal (Lazarus/Delphi)

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.Ssh,
  Chilkat.Xml;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  ssh: TSsh;
  hostname: string;
  port: Integer;
  xmlResponse: string;
  xml: TXml;
  password: string;

begin
  success := False;

  //  This example requires the Chilkat API to have been previously unlocked.
  //  See Global Unlock Sample for sample code.

  //  Demonstrates keyboard-interactive authentication with an SSH server.  The server sends one or
  //  more prompts as XML, and the application answers each with ContinueKeyboardAuth.

  ssh := TSsh.Create;

  ssh.ConnectTimeoutMs := 5000;
  ssh.ReadTimeoutMs := 15000;

  hostname := 'ssh.example.com';
  port := 22;
  success := ssh.Connect(hostname,port);
  if (success = False) then
    begin
      WriteLn(ssh.LastErrorText);
      Exit;
    end;

  //  Begin keyboard-interactive authentication.  The returned XML describes the server's prompts.
  xmlResponse := ssh.StartKeyboardAuth('mySshLogin');
  if (ssh.LastMethodSuccess = False) then
    begin
      WriteLn(ssh.LastErrorText);
      Exit;
    end;

  //  If the server sent a user authentication banner, an application may display it before
  //  prompting.
  WriteLn('UserAuthBanner: ' + ssh.UserAuthBanner);

  xml := TXml.Create;
  success := xml.LoadXml(xmlResponse);
  if (success = False) then
    begin
      WriteLn(xml.LastErrorText);
      Exit;
    end;

  //  Authentication is complete when the XML contains either a "success" or an "error" node.
  if (xml.HasChildWithTag('success')) then
    begin
      WriteLn('No password required, already authenticated.');
      Exit;
    end;

  if (xml.HasChildWithTag('error')) then
    begin
      WriteLn('Authentication failed.');
      Exit;
    end;

  //  Normally you would not hard-code the password in source.  You should instead obtain it
  //  from an interactive prompt, environment variable, or a secrets vault.
  password := 'mySshPassword';

  //  Answer the prompt.  Typically one call is enough, but a server may issue several rounds of
  //  prompts, so a robust client loops until it sees "success" or "error".
  xmlResponse := ssh.ContinueKeyboardAuth(password);
  if (ssh.LastMethodSuccess = False) then
    begin
      WriteLn(ssh.LastErrorText);
      Exit;
    end;

  success := xml.LoadXml(xmlResponse);
  if (success = False) then
    begin
      WriteLn(xml.LastErrorText);
      Exit;
    end;

  if (xml.HasChildWithTag('success')) then
    begin
      WriteLn('SSH keyboard-interactive authentication successful.');
      Exit;
    end;

  if (xml.HasChildWithTag('error')) then
    begin
      WriteLn('Authentication failed.');
    end;


  ssh.Free;
  xml.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.