SQL Server

SFTP Set Allowed Algorithms

See more SFTP Examples

Demonstrates how to explicitly set the algorithms allowed in the SSH connection protocol for SFTP.

Note: This example requires Chilkat v9.5.0.99 or greater.

SQL Server

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @sTmp0 nvarchar(4000)
    DECLARE @success int
    SELECT @success = 0

    --  This example requires the Chilkat API to have been previously unlocked.
    --  See Global Unlock Sample for sample code.

    DECLARE @sftp int
    EXEC @hr = sp_OACreate 'Chilkat.SFtp', @sftp OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    DECLARE @json int
    EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @json OUT

    --  Here are the algorithms supported by Chilkat at the time this example was written (14-June-2024)

    --  ---------------------------
    --  SSH Key-Exchange Algorithms
    --  ---------------------------
    --  curve25519-sha256
    --  curve25519-sha256@libssh.org
    --  ecdh-sha2-nistp256
    --  ecdh-sha2-nistp384
    --  ecdh-sha2-nistp521
    --  diffie-hellman-group14-sha256
    --  diffie-hellman-group16-sha512
    --  diffie-hellman-group18-sha512
    --  diffie-hellman-group-exchange-sha256
    --  diffie-hellman-group1-sha1
    --  diffie-hellman-group14-sha1
    --  diffie-hellman-group-exchange-sha1

    --  ---------------------------
    --  SSH Host Key Algorithms
    --  ---------------------------
    --  ssh-ed25519
    --  ecdsa-sha2-nistp256
    --  ecdsa-sha2-nistp384
    --  ecdsa-sha2-nistp521
    --  rsa-sha2-256
    --  rsa-sha2-512
    --  ssh-rsa
    --  ssh-dss

    --  ---------------------------
    --  SSH Cipher Algorithms
    --  ---------------------------
    --  chacha20-poly1305@openssh.com
    --  aes128-ctr
    --  aes256-ctr
    --  aes192-ctr
    --  aes128-cbc
    --  aes256-cbc
    --  aes192-cbc
    --  aes128-gcm@openssh.com
    --  aes256-gcm@openssh.com
    --  twofish256-cbc
    --  twofish128-cbc
    --  blowfish-cbc

    --  ---------------------------
    --  SSH MAC Algorithms
    --  ---------------------------
    --  hmac-sha2-256
    --  hmac-sha2-512
    --  hmac-sha2-256-etm@openssh.com
    --  hmac-sha2-512-etm@openssh.com
    --  hmac-sha1-etm@openssh.com
    --  hmac-sha1
    --  hmac-ripemd160
    --  hmac-sha1-96
    --  hmac-md5

    --  Specify the allowed key-exchange, host-key, cipher (i.e. encryption), and mac (i.e. hash) algorithms allowed, in the order of preference.
    --  -------------------------------------------------------------------------------------------------------------------------------------------
    --  Note: You typically should NOT explicitly set allowed algorithms.
    --  By default, Chilkat orders algorithms according to best practices, and pays attention to vulnerabilities such as the "Terrapin Attack".
    --  Hard-coding algorthims can make your application brittle and prone to breaking over a long period of time,
    --  if a server (at some point in the future) changes its allowed algorithms, or if you connect to a different server,
    --  such that the client (Chilkat) and server cannot find a set of mutually agreed-upon algorithms.
    --  -------------------------------------------------------------------------------------------------------------------------------------------
    DECLARE @allowed_kex nvarchar(4000)
    SELECT @allowed_kex = 'curve25519-sha256@libssh.org,ecdh-sha2-nistp256'
    DECLARE @allowed_hostKey nvarchar(4000)
    SELECT @allowed_hostKey = 'ssh-ed25519,ecdsa-sha2-nistp256'
    DECLARE @allowed_cipher nvarchar(4000)
    SELECT @allowed_cipher = 'chacha20-poly1305@openssh.com,aes256-ctr'
    DECLARE @allowed_mac nvarchar(4000)
    SELECT @allowed_mac = 'hmac-sha2-256,hmac-sha2-512'

    EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'kex', @allowed_kex
    EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'hostKey', @allowed_hostKey
    EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'cipher', @allowed_cipher
    EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'mac', @allowed_mac
    EXEC sp_OAMethod @sftp, 'SetAllowedAlgorithms', @success OUT, @json

    DECLARE @port int
    SELECT @port = 22
    EXEC sp_OAMethod @sftp, 'Connect', @success OUT, 'example.com', @port
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @sftp, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @sftp
        EXEC @hr = sp_OADestroy @json
        RETURN
      END


    PRINT 'Connected.'

    --  ....
    --  ....

    EXEC @hr = sp_OADestroy @sftp
    EXEC @hr = sp_OADestroy @json


END
GO