PowerBuilder

SSH Tunnel Authenticate with Secure Strings

Demonstrates SSH tunnel password authentication using SecureString objects, with the credentials read from an encrypted JSON config file and decrypted directly into secure strings rather than being hard-coded in source.

Background: The SshTunnel class runs the tunnel on a background thread, so it authenticates once and then serves connections until closed — which makes protecting the stored credential especially worthwhile. Decrypting straight into a SecureString avoids ever holding the password in an ordinary string, and the value stays encrypted in memory under a randomly generated session key. In production the decryption key itself would come from a key vault or OS keystore rather than a literal.

Chilkat PowerBuilder Downloads

Download Chilkat for PowerBuilder

PowerBuilder

integer li_rc
integer li_Success
oleobject loo_Json
oleobject loo_Crypt
oleobject loo_SsLogin
oleobject loo_SsPassword
oleobject loo_Tunnel
integer li_Port
integer li_WaitForThreadExit

li_Success = 0

//  This example requires the Chilkat API to have been previously unlocked.
//  See Global Unlock Sample for sample code.

//  Demonstrates SSH tunnel password authentication using SecureString objects, with the
//  credentials read from an encrypted config file rather than hard-coded in source.

//  Imagine the login and password were previously encrypted and saved in a JSON config file:
//  {
//    "ssh_login": "2+qylFfC56Ck7OQQt/U2/w==",
//    "ssh_password": "5neIq9Jmn0E3p71N6Yc8TA=="
//  }
loo_Json = create oleobject
li_rc = loo_Json.ConnectToNewObject("Chilkat.JsonObject")
if li_rc < 0 then
    destroy loo_Json
    MessageBox("Error","Connecting to COM object failed")
    return
end if
li_Success = loo_Json.LoadFile("qa_data/passwords/ssh.json")
if li_Success = 0 then
    Write-Debug loo_Json.LastErrorText
    destroy loo_Json
    return
end if

//  These are the encryption settings used when the credentials were encrypted.  In a real
//  application the key would come from a secure source, not a literal.
loo_Crypt = create oleobject
li_rc = loo_Crypt.ConnectToNewObject("Chilkat.Crypt2")

loo_Crypt.CryptAlgorithm = "aes"
loo_Crypt.CipherMode = "cbc"
loo_Crypt.KeyLength = 128
loo_Crypt.SetEncodedKey("000102030405060708090A0B0C0D0E0F","hex")
loo_Crypt.SetEncodedIV("000102030405060708090A0B0C0D0E0F","hex")
loo_Crypt.EncodingMode = "base64"

//  Decrypt directly into SecureString objects.  The values stay encrypted in memory, now under
//  a randomly generated session key.
loo_SsLogin = create oleobject
li_rc = loo_SsLogin.ConnectToNewObject("Chilkat.SecureString")

loo_SsPassword = create oleobject
li_rc = loo_SsPassword.ConnectToNewObject("Chilkat.SecureString")

loo_Crypt.DecryptSecureENC(loo_Json.StringOf("ssh_login"),loo_SsLogin)
loo_Crypt.DecryptSecureENC(loo_Json.StringOf("ssh_password"),loo_SsPassword)

loo_Tunnel = create oleobject
li_rc = loo_Tunnel.ConnectToNewObject("Chilkat.SshTunnel")

li_Port = 22
li_Success = loo_Tunnel.Connect("ssh.example.com",li_Port)
if li_Success = 0 then
    Write-Debug loo_Tunnel.LastErrorText
    destroy loo_Json
    destroy loo_Crypt
    destroy loo_SsLogin
    destroy loo_SsPassword
    destroy loo_Tunnel
    return
end if

//  Authenticate using the secure strings.
li_Success = loo_Tunnel.AuthenticateSecPw(loo_SsLogin,loo_SsPassword)
if li_Success = 0 then
    Write-Debug loo_Tunnel.LastErrorText
    destroy loo_Json
    destroy loo_Crypt
    destroy loo_SsLogin
    destroy loo_SsPassword
    destroy loo_Tunnel
    return
end if

Write-Debug "SSH tunnel authentication successful."

//  ... use the tunnel ...

li_WaitForThreadExit = 1
li_Success = loo_Tunnel.CloseTunnel(li_WaitForThreadExit)
if li_Success = 0 then
    Write-Debug loo_Tunnel.LastErrorText
    destroy loo_Json
    destroy loo_Crypt
    destroy loo_SsLogin
    destroy loo_SsPassword
    destroy loo_Tunnel
    return
end if



destroy loo_Json
destroy loo_Crypt
destroy loo_SsLogin
destroy loo_SsPassword
destroy loo_Tunnel