SQL Server

Set the FTP Password from a SecureString

Demonstrates the Chilkat Ftp2.SetSecurePassword method, which sets the login password from a SecureString. The only argument is the SecureString. It is equivalent to setting the Password property but avoids holding the password as an ordinary immutable string.

Background: An ordinary string password can linger in memory (and in memory dumps) because strings are immutable and copied freely. A SecureString keeps the value encrypted under a session key and clears it deterministically, reducing that exposure — a sensible upgrade for a credential the process holds for the life of the connection. Populate it from a runtime source rather than a hard-coded literal.

Chilkat SQL Server Downloads

Download Chilkat for SQL Server

SQL Server

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @sTmp0 nvarchar(4000)
    DECLARE @success int
    SELECT @success = 0

    --  Demonstrates the Ftp2.SetSecurePassword method, which sets the login password from a
    --  SecureString.  The only argument is the SecureString.  This avoids holding the password as an
    --  ordinary immutable string.

    DECLARE @ftp int
    EXEC @hr = sp_OACreate 'Chilkat.Ftp2', @ftp OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    EXEC sp_OASetProperty @ftp, 'Hostname', 'ftp.example.com'
    EXEC sp_OASetProperty @ftp, 'Username', 'myFtpLogin'

    --  Normally you would not hard-code the password in source.  You should instead obtain it
    --  from an interactive prompt, environment variable, or a secrets vault.
    DECLARE @password nvarchar(4000)
    SELECT @password = 'myPassword'

    --  Place the password into a SecureString, which keeps it encrypted in memory.
    DECLARE @securePassword int
    EXEC @hr = sp_OACreate 'Chilkat.SecureString', @securePassword OUT

    EXEC sp_OAMethod @securePassword, 'Append', @success OUT, @password

    --  Setting the secure password is equivalent to setting the Password property, but more
    --  protective.
    EXEC sp_OAMethod @ftp, 'SetSecurePassword', @success OUT, @securePassword
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @ftp, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @ftp
        EXEC @hr = sp_OADestroy @securePassword
        RETURN
      END

    EXEC sp_OAMethod @ftp, 'Connect', @success OUT
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @ftp, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @ftp
        EXEC @hr = sp_OADestroy @securePassword
        RETURN
      END

    PRINT 'Connected using a secure password.'

    EXEC sp_OAMethod @ftp, 'Disconnect', @success OUT
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @ftp, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @ftp
        EXEC @hr = sp_OADestroy @securePassword
        RETURN
      END

    EXEC @hr = sp_OADestroy @ftp
    EXEC @hr = sp_OADestroy @securePassword


END
GO