PureBasic

SSH Keyboard-Interactive Authentication

Demonstrates keyboard-interactive authentication with an SSH server. StartKeyboardAuth returns XML describing the server's prompts, and ContinueKeyboardAuth submits each response. Authentication is complete when the returned XML contains either a success or an error node.

Background: Keyboard-interactive is SSH's flexible, prompt-driven method: rather than assuming a single password, the server asks one or more questions — a password, a one-time code, a security question — and the client answers each. This is how SSH supports two-factor and other challenge-response schemes. The prompt XML also indicates whether each response should be echoed, so a client knows when to mask input. A server may issue several rounds, so a robust implementation loops until it sees success or error rather than assuming one exchange is enough.

Chilkat PureBasic Downloads

Download Chilkat for PureBasic

PureBasic

IncludeFile "CkSsh.pb"
IncludeFile "CkXml.pb"

Procedure ChilkatExample()

    success.i = 0

    ;  This example requires the Chilkat API to have been previously unlocked.
    ;  See Global Unlock Sample for sample code.

    ;  Demonstrates keyboard-interactive authentication with an SSH server.  The server sends one or
    ;  more prompts as XML, and the application answers each with ContinueKeyboardAuth.

    ssh.i = CkSsh::ckCreate()
    If ssh.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkSsh::setCkConnectTimeoutMs(ssh, 5000)
    CkSsh::setCkReadTimeoutMs(ssh, 15000)

    hostname.s = "ssh.example.com"
    port.i = 22
    success = CkSsh::ckConnect(ssh,hostname,port)
    If success = 0
        Debug CkSsh::ckLastErrorText(ssh)
        CkSsh::ckDispose(ssh)
        ProcedureReturn
    EndIf

    ;  Begin keyboard-interactive authentication.  The returned XML describes the server's prompts.
    xmlResponse.s = CkSsh::ckStartKeyboardAuth(ssh,"mySshLogin")
    If CkSsh::ckLastMethodSuccess(ssh) = 0
        Debug CkSsh::ckLastErrorText(ssh)
        CkSsh::ckDispose(ssh)
        ProcedureReturn
    EndIf

    ;  If the server sent a user authentication banner, an application may display it before
    ;  prompting.
    Debug "UserAuthBanner: " + CkSsh::ckUserAuthBanner(ssh)

    xml.i = CkXml::ckCreate()
    If xml.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkXml::ckLoadXml(xml,xmlResponse)
    If success = 0
        Debug CkXml::ckLastErrorText(xml)
        CkSsh::ckDispose(ssh)
        CkXml::ckDispose(xml)
        ProcedureReturn
    EndIf

    ;  Authentication is complete when the XML contains either a "success" or an "error" node.
    If CkXml::ckHasChildWithTag(xml,"success")
        Debug "No password required, already authenticated."
        CkSsh::ckDispose(ssh)
        CkXml::ckDispose(xml)
        ProcedureReturn
    EndIf

    If CkXml::ckHasChildWithTag(xml,"error")
        Debug "Authentication failed."
        CkSsh::ckDispose(ssh)
        CkXml::ckDispose(xml)
        ProcedureReturn
    EndIf

    ;  Normally you would not hard-code the password in source.  You should instead obtain it
    ;  from an interactive prompt, environment variable, or a secrets vault.
    password.s = "mySshPassword"

    ;  Answer the prompt.  Typically one call is enough, but a server may issue several rounds of
    ;  prompts, so a robust client loops until it sees "success" or "error".
    xmlResponse = CkSsh::ckContinueKeyboardAuth(ssh,password)
    If CkSsh::ckLastMethodSuccess(ssh) = 0
        Debug CkSsh::ckLastErrorText(ssh)
        CkSsh::ckDispose(ssh)
        CkXml::ckDispose(xml)
        ProcedureReturn
    EndIf

    success = CkXml::ckLoadXml(xml,xmlResponse)
    If success = 0
        Debug CkXml::ckLastErrorText(xml)
        CkSsh::ckDispose(ssh)
        CkXml::ckDispose(xml)
        ProcedureReturn
    EndIf

    If CkXml::ckHasChildWithTag(xml,"success")
        Debug "SSH keyboard-interactive authentication successful."
        CkSsh::ckDispose(ssh)
        CkXml::ckDispose(xml)
        ProcedureReturn
    EndIf

    If CkXml::ckHasChildWithTag(xml,"error")
        Debug "Authentication failed."
    EndIf



    CkSsh::ckDispose(ssh)
    CkXml::ckDispose(xml)


    ProcedureReturn
EndProcedure