DataFlex

SSH Authentication using an SSH Certificate

Demonstrates authenticating with an SSH server using an SSH certificate. The private key is imported into an SshKey object, UseSshCertificate attaches the certificate, and AuthenticatePk performs the authentication. See Understanding SSH Certificates for background.

Note: The file paths are relative to the application's current working directory. Supply the paths to your own files.

Background: An SSH certificate is a public key signed by a certificate authority, and it solves the scaling problem of ordinary public-key authentication: instead of copying every user's public key into authorized_keys on every server, each server simply trusts the CA. Certificates also carry an expiration, so access lapses automatically rather than lingering until someone remembers to remove a key. Note this is distinct from X.509 certificates — the SSH certificate format is its own thing.

Chilkat DataFlex Downloads

Download Chilkat for DataFlex

DataFlex

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoSbSshCert
    Handle hoSbPrivKey
    Variant vKey
    Handle hoKey
    String sPrivKeyText
    String sSshCertText
    Handle hoSsh
    String sHostname
    Integer iPort
    String sTemp1

    Move False To iSuccess

    //  This example requires the Chilkat API to have been previously unlocked.
    //  See Global Unlock Sample for sample code.

    //  Demonstrates authenticating with an SSH server using an SSH certificate.  An SSH certificate
    //  is a signed public key: the server trusts the certificate authority that signed it, rather
    //  than holding a copy of each user's public key.

    Get Create (RefClass(cComChilkatStringBuilder)) To hoSbSshCert
    If (Not(IsComObjectCreated(hoSbSshCert))) Begin
        Send CreateComObject of hoSbSshCert
    End
    Get ComLoadFile Of hoSbSshCert "qa_data/sshCert/user_ecdsa_key-cert.pub" "utf-8" To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSbSshCert To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Get Create (RefClass(cComChilkatStringBuilder)) To hoSbPrivKey
    If (Not(IsComObjectCreated(hoSbPrivKey))) Begin
        Send CreateComObject of hoSbPrivKey
    End
    Get ComLoadFile Of hoSbPrivKey "qa_data/sshKeys/user_ecdsa_key" "utf-8" To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSbPrivKey To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Get Create (RefClass(cComChilkatSshKey)) To hoKey
    If (Not(IsComObjectCreated(hoKey))) Begin
        Send CreateComObject of hoKey
    End

    //  Set the password if the private key file is stored encrypted.  This should come from a
    //  secure source rather than being hard-coded.
    Set ComPassword Of hoKey To "myKeyPassword"

    Get ComGetAsString Of hoSbPrivKey To sPrivKeyText
    Get ComFromOpenSshPrivateKey Of hoKey sPrivKeyText To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoKey To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  Indicate that the SSH certificate is to be used for authentication.
    Get ComGetAsString Of hoSbSshCert To sSshCertText
    Get ComUseSshCertificate Of hoKey sSshCertText To iSuccess

    Get Create (RefClass(cComChilkatSsh)) To hoSsh
    If (Not(IsComObjectCreated(hoSsh))) Begin
        Send CreateComObject of hoSsh
    End

    Move "ssh.example.com" To sHostname
    Move 22 To iPort
    Get ComConnect Of hoSsh sHostname iPort To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Get pvComObject of hoKey to vKey
    Get ComAuthenticatePk Of hoSsh "mySshLogin" vKey To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Showln "Public-key authentication using an SSH certificate was successful."

    Send ComDisconnect To hoSsh


End_Procedure