Tcl

Set the FTP Password from a SecureString

Demonstrates the Chilkat Ftp2.SetSecurePassword method, which sets the login password from a SecureString. The only argument is the SecureString. It is equivalent to setting the Password property but avoids holding the password as an ordinary immutable string.

Background: An ordinary string password can linger in memory (and in memory dumps) because strings are immutable and copied freely. A SecureString keeps the value encrypted under a session key and clears it deterministically, reducing that exposure — a sensible upgrade for a credential the process holds for the life of the connection. Populate it from a runtime source rather than a hard-coded literal.

Chilkat Tcl Downloads

Download Chilkat for Tcl

Tcl


load ./chilkat.dll

set success 0

#  Demonstrates the Ftp2.SetSecurePassword method, which sets the login password from a
#  SecureString.  The only argument is the SecureString.  This avoids holding the password as an
#  ordinary immutable string.

set ftp [new_CkFtp2]

CkFtp2_put_Hostname $ftp "ftp.example.com"
CkFtp2_put_Username $ftp "myFtpLogin"

#  Normally you would not hard-code the password in source.  You should instead obtain it
#  from an interactive prompt, environment variable, or a secrets vault.
set password "myPassword"

#  Place the password into a SecureString, which keeps it encrypted in memory.
set securePassword [new_CkSecureString]

CkSecureString_Append $securePassword $password

#  Setting the secure password is equivalent to setting the Password property, but more
#  protective.
set success [CkFtp2_SetSecurePassword $ftp $securePassword]
if {$success == 0} then {
    puts [CkFtp2_lastErrorText $ftp]
    delete_CkFtp2 $ftp
    delete_CkSecureString $securePassword
    exit
}

set success [CkFtp2_Connect $ftp]
if {$success == 0} then {
    puts [CkFtp2_lastErrorText $ftp]
    delete_CkFtp2 $ftp
    delete_CkSecureString $securePassword
    exit
}

puts "Connected using a secure password."

set success [CkFtp2_Disconnect $ftp]
if {$success == 0} then {
    puts [CkFtp2_lastErrorText $ftp]
    delete_CkFtp2 $ftp
    delete_CkSecureString $securePassword
    exit
}


delete_CkFtp2 $ftp
delete_CkSecureString $securePassword