PureBasic

SSH Authenticate with a SecureString Password and Private Key

Demonstrates the Chilkat Ssh.AuthenticateSecPwPk method, which performs the same combined password/private-key authentication as AuthenticatePwPk but receives the username and password as SecureString objects. The third argument is the SshKey private key.

Note: The private-key path is relative to the application's current working directory. Supply the path to your own key file.

Background: This is the SecureString form of multi-factor SSH authentication: the password is held encrypted in memory and combined with a private key for servers that require both. It is the most protective option when a deployment mandates two-factor SSH and you also want to minimize plaintext credential exposure in the process.

Chilkat PureBasic Downloads

Download Chilkat for PureBasic

PureBasic

IncludeFile "CkSshKey.pb"
IncludeFile "CkSecureString.pb"
IncludeFile "CkSsh.pb"

Procedure ChilkatExample()

    success.i = 0

    ;  Demonstrates the Ssh.AuthenticateSecPwPk method, which authenticates using SecureString login
    ;  and password objects together with a private key.  The 1st argument is the username, the 2nd
    ;  is the password, and the 3rd is an SshKey private key.

    ssh.i = CkSsh::ckCreate()
    If ssh.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ;  Connect to the SSH server.  Port 22 is the usual SSH port.
    sshPort.i = 22
    success = CkSsh::ckConnect(ssh,"ssh.example.com",sshPort)
    If success = 0
        Debug CkSsh::ckLastErrorText(ssh)
        CkSsh::ckDispose(ssh)
        ProcedureReturn
    EndIf

    ;  Normally you would not hard-code the password in source.  You should instead obtain it
    ;  from an interactive prompt, environment variable, or a secrets vault.
    password.s = "mySshPassword"

    ;  Load the SSH private key.  LoadText reads the file's text, which is then imported.
    privKey.i = CkSshKey::ckCreate()
    If privKey.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    keyStr.s = CkSshKey::ckLoadText(privKey,"qa_data/id_rsa")
    If CkSshKey::ckLastMethodSuccess(privKey) = 0
        Debug CkSshKey::ckLastErrorText(privKey)
        CkSsh::ckDispose(ssh)
        CkSshKey::ckDispose(privKey)
        ProcedureReturn
    EndIf

    success = CkSshKey::ckFromOpenSshPrivateKey(privKey,keyStr)
    If success = 0
        Debug CkSshKey::ckLastErrorText(privKey)
        CkSsh::ckDispose(ssh)
        CkSshKey::ckDispose(privKey)
        ProcedureReturn
    EndIf

    ;  Place the login and password into SecureString objects.
    secureLogin.i = CkSecureString::ckCreate()
    If secureLogin.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkSecureString::ckAppend(secureLogin,"mySshLogin")
    securePassword.i = CkSecureString::ckCreate()
    If securePassword.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkSecureString::ckAppend(securePassword,password)

    success = CkSsh::ckAuthenticateSecPwPk(ssh,secureLogin,securePassword,privKey)
    If success = 0
        Debug CkSsh::ckLastErrorText(ssh)
        CkSsh::ckDispose(ssh)
        CkSshKey::ckDispose(privKey)
        CkSecureString::ckDispose(secureLogin)
        CkSecureString::ckDispose(securePassword)
        ProcedureReturn
    EndIf

    Debug "Authenticated."

    CkSsh::ckDisconnect(ssh)


    CkSsh::ckDispose(ssh)
    CkSshKey::ckDispose(privKey)
    CkSecureString::ckDispose(secureLogin)
    CkSecureString::ckDispose(securePassword)


    ProcedureReturn
EndProcedure