PureBasic

SSH Tunnel Authenticate with Secure Strings

Demonstrates SSH tunnel password authentication using SecureString objects, with the credentials read from an encrypted JSON config file and decrypted directly into secure strings rather than being hard-coded in source.

Background: The SshTunnel class runs the tunnel on a background thread, so it authenticates once and then serves connections until closed — which makes protecting the stored credential especially worthwhile. Decrypting straight into a SecureString avoids ever holding the password in an ordinary string, and the value stays encrypted in memory under a randomly generated session key. In production the decryption key itself would come from a key vault or OS keystore rather than a literal.

Chilkat PureBasic Downloads

Download Chilkat for PureBasic

PureBasic

IncludeFile "CkSshTunnel.pb"
IncludeFile "CkJsonObject.pb"
IncludeFile "CkSecureString.pb"
IncludeFile "CkCrypt2.pb"

Procedure ChilkatExample()

    success.i = 0

    ;  This example requires the Chilkat API to have been previously unlocked.
    ;  See Global Unlock Sample for sample code.

    ;  Demonstrates SSH tunnel password authentication using SecureString objects, with the
    ;  credentials read from an encrypted config file rather than hard-coded in source.

    ;  Imagine the login and password were previously encrypted and saved in a JSON config file:
    ;  {
    ;    "ssh_login": "2+qylFfC56Ck7OQQt/U2/w==",
    ;    "ssh_password": "5neIq9Jmn0E3p71N6Yc8TA=="
    ;  }
    json.i = CkJsonObject::ckCreate()
    If json.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkJsonObject::ckLoadFile(json,"qa_data/passwords/ssh.json")
    If success = 0
        Debug CkJsonObject::ckLastErrorText(json)
        CkJsonObject::ckDispose(json)
        ProcedureReturn
    EndIf

    ;  These are the encryption settings used when the credentials were encrypted.  In a real
    ;  application the key would come from a secure source, not a literal.
    crypt.i = CkCrypt2::ckCreate()
    If crypt.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkCrypt2::setCkCryptAlgorithm(crypt, "aes")
    CkCrypt2::setCkCipherMode(crypt, "cbc")
    CkCrypt2::setCkKeyLength(crypt, 128)
    CkCrypt2::ckSetEncodedKey(crypt,"000102030405060708090A0B0C0D0E0F","hex")
    CkCrypt2::ckSetEncodedIV(crypt,"000102030405060708090A0B0C0D0E0F","hex")
    CkCrypt2::setCkEncodingMode(crypt, "base64")

    ;  Decrypt directly into SecureString objects.  The values stay encrypted in memory, now under
    ;  a randomly generated session key.
    ssLogin.i = CkSecureString::ckCreate()
    If ssLogin.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ssPassword.i = CkSecureString::ckCreate()
    If ssPassword.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkCrypt2::ckDecryptSecureENC(crypt,CkJsonObject::ckStringOf(json,"ssh_login"),ssLogin)
    CkCrypt2::ckDecryptSecureENC(crypt,CkJsonObject::ckStringOf(json,"ssh_password"),ssPassword)

    tunnel.i = CkSshTunnel::ckCreate()
    If tunnel.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    port.i = 22
    success = CkSshTunnel::ckConnect(tunnel,"ssh.example.com",port)
    If success = 0
        Debug CkSshTunnel::ckLastErrorText(tunnel)
        CkJsonObject::ckDispose(json)
        CkCrypt2::ckDispose(crypt)
        CkSecureString::ckDispose(ssLogin)
        CkSecureString::ckDispose(ssPassword)
        CkSshTunnel::ckDispose(tunnel)
        ProcedureReturn
    EndIf

    ;  Authenticate using the secure strings.
    success = CkSshTunnel::ckAuthenticateSecPw(tunnel,ssLogin,ssPassword)
    If success = 0
        Debug CkSshTunnel::ckLastErrorText(tunnel)
        CkJsonObject::ckDispose(json)
        CkCrypt2::ckDispose(crypt)
        CkSecureString::ckDispose(ssLogin)
        CkSecureString::ckDispose(ssPassword)
        CkSshTunnel::ckDispose(tunnel)
        ProcedureReturn
    EndIf

    Debug "SSH tunnel authentication successful."

    ;  ... use the tunnel ...

    waitForThreadExit.i = 1
    success = CkSshTunnel::ckCloseTunnel(tunnel,waitForThreadExit)
    If success = 0
        Debug CkSshTunnel::ckLastErrorText(tunnel)
        CkJsonObject::ckDispose(json)
        CkCrypt2::ckDispose(crypt)
        CkSecureString::ckDispose(ssLogin)
        CkSecureString::ckDispose(ssPassword)
        CkSshTunnel::ckDispose(tunnel)
        ProcedureReturn
    EndIf



    CkJsonObject::ckDispose(json)
    CkCrypt2::ckDispose(crypt)
    CkSecureString::ckDispose(ssLogin)
    CkSecureString::ckDispose(ssPassword)
    CkSshTunnel::ckDispose(tunnel)


    ProcedureReturn
EndProcedure