PureBasic

SSH Authentication using an SSH Certificate

Demonstrates authenticating with an SSH server using an SSH certificate. The private key is imported into an SshKey object, UseSshCertificate attaches the certificate, and AuthenticatePk performs the authentication. See Understanding SSH Certificates for background.

Note: The file paths are relative to the application's current working directory. Supply the paths to your own files.

Background: An SSH certificate is a public key signed by a certificate authority, and it solves the scaling problem of ordinary public-key authentication: instead of copying every user's public key into authorized_keys on every server, each server simply trusts the CA. Certificates also carry an expiration, so access lapses automatically rather than lingering until someone remembers to remove a key. Note this is distinct from X.509 certificates — the SSH certificate format is its own thing.

Chilkat PureBasic Downloads

Download Chilkat for PureBasic

PureBasic

IncludeFile "CkSshKey.pb"
IncludeFile "CkStringBuilder.pb"
IncludeFile "CkSsh.pb"

Procedure ChilkatExample()

    success.i = 0

    ;  This example requires the Chilkat API to have been previously unlocked.
    ;  See Global Unlock Sample for sample code.

    ;  Demonstrates authenticating with an SSH server using an SSH certificate.  An SSH certificate
    ;  is a signed public key: the server trusts the certificate authority that signed it, rather
    ;  than holding a copy of each user's public key.

    sbSshCert.i = CkStringBuilder::ckCreate()
    If sbSshCert.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkStringBuilder::ckLoadFile(sbSshCert,"qa_data/sshCert/user_ecdsa_key-cert.pub","utf-8")
    If success = 0
        Debug CkStringBuilder::ckLastErrorText(sbSshCert)
        CkStringBuilder::ckDispose(sbSshCert)
        ProcedureReturn
    EndIf

    sbPrivKey.i = CkStringBuilder::ckCreate()
    If sbPrivKey.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkStringBuilder::ckLoadFile(sbPrivKey,"qa_data/sshKeys/user_ecdsa_key","utf-8")
    If success = 0
        Debug CkStringBuilder::ckLastErrorText(sbPrivKey)
        CkStringBuilder::ckDispose(sbSshCert)
        CkStringBuilder::ckDispose(sbPrivKey)
        ProcedureReturn
    EndIf

    key.i = CkSshKey::ckCreate()
    If key.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ;  Set the password if the private key file is stored encrypted.  This should come from a
    ;  secure source rather than being hard-coded.
    CkSshKey::setCkPassword(key, "myKeyPassword")

    privKeyText.s = CkStringBuilder::ckGetAsString(sbPrivKey)
    success = CkSshKey::ckFromOpenSshPrivateKey(key,privKeyText)
    If success = 0
        Debug CkSshKey::ckLastErrorText(key)
        CkStringBuilder::ckDispose(sbSshCert)
        CkStringBuilder::ckDispose(sbPrivKey)
        CkSshKey::ckDispose(key)
        ProcedureReturn
    EndIf

    ;  Indicate that the SSH certificate is to be used for authentication.
    sshCertText.s = CkStringBuilder::ckGetAsString(sbSshCert)
    CkSshKey::ckUseSshCertificate(key,sshCertText)

    ssh.i = CkSsh::ckCreate()
    If ssh.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    hostname.s = "ssh.example.com"
    port.i = 22
    success = CkSsh::ckConnect(ssh,hostname,port)
    If success = 0
        Debug CkSsh::ckLastErrorText(ssh)
        CkStringBuilder::ckDispose(sbSshCert)
        CkStringBuilder::ckDispose(sbPrivKey)
        CkSshKey::ckDispose(key)
        CkSsh::ckDispose(ssh)
        ProcedureReturn
    EndIf

    success = CkSsh::ckAuthenticatePk(ssh,"mySshLogin",key)
    If success = 0
        Debug CkSsh::ckLastErrorText(ssh)
        CkStringBuilder::ckDispose(sbSshCert)
        CkStringBuilder::ckDispose(sbPrivKey)
        CkSshKey::ckDispose(key)
        CkSsh::ckDispose(ssh)
        ProcedureReturn
    EndIf

    Debug "Public-key authentication using an SSH certificate was successful."

    CkSsh::ckDisconnect(ssh)


    CkStringBuilder::ckDispose(sbSshCert)
    CkStringBuilder::ckDispose(sbPrivKey)
    CkSshKey::ckDispose(key)
    CkSsh::ckDispose(ssh)


    ProcedureReturn
EndProcedure