Need SSH Tunnel?  LibSSH2 and Synapse?
lazarus / 38-Networking and Web Programming

----------------------------------------------------------------------
snorkel · 2012-09-12 14:27

HI,
I am in the need of creating a SSH tunnel in my app(need to tunnel a
postgresql db connection)
and noticed there is a partial Synapse libSSH2 plugin.
http://wiki.freepascal.org/Synapse#Synapse_libssh2_SSL_plugin
Problem is I have no idea how to create a tunnel with this.

Has anyone been using the plugin ? or LibSSH2 with Lazarus?

Thanks,

Snorkel

----------------------------------------------------------------------
ezlage · 2012-09-12 20:06

Hi.

See: http://dev.mysql.com/doc/refman/5.0/en/ssl-connections.html

[Example] In your MySQL:
Code: [Select]CREATE DATABASE public;
USE public;

DELIMITER $$
DROP PROCEDURE IF EXISTS `GetNow` $$
CREATE PROCEDURE `GetNow`()
BEGIN
//you can implement here a checking of session [in this case, header
need to be something like this: `GetNow`(IN session VARCHAR(128)], if
ok then
SELECT now() AS `nowis`;
END $$
DELIMITER ;

GRANT EXECUTE ON PROCEDURE public.GetNow TO 'public'@'%' IDENTIFIED BY
'somepassword' REQUIRE SSL;

See: http://dev.mysql.com/doc/refman/5.0/en/grant.html

The Lazarus DataSet components must have the password, but it isn't
safe to store the password, so you can use the TStrHolder for
obfuscating and/or some complex logic to encrypt/decrypt the string
before use it

To connect, the client must specify the --ssl-ca option to
authenticate the server certificate, and may additionally specify the
--ssl-key and --ssl-cert options. If neither --ssl-ca option nor
--ssl-capath option is specified, the client does not authenticate the
server certificate.

See: http://dev.mysql.com/doc/refman/5.0/en/replication-solutions-
ssl.html

----------------------------------------------------------------------
ezlage · 2012-09-12 20:14

But, this way you need to use ODBC or something like this to connect.
=/
Lazarus and Zeos seems not able to use SSL for databases access.

May a VPN connection be more easy to implement.

----------------------------------------------------------------------
snorkel · 2012-09-12 21:03

Hi Guys,
I can connect fine with SSL, what I am looking for is a way to
add a SSH tunnel into my app with libssh2.

A lot of times especially on a linux box, the postgresql database is
restricted to accepting only
local connections, and you can with a SSH tunnel connect because the
SSH server forwards it from a local connection.

i can of course fire up putty or SSH command line and  create a
tunnel, but I need something I can build right in.  I tried using
Tprocess to use command line SSH, but there is no way to pass it a
password because SSH won't accept a  password over standard input.

----------------------------------------------------------------------
taazz · 2012-09-12 23:24

on this thread  you can find some information about implementing ssh
and an sftp sample build with synapse and CryptLib.

If you manage to create a connection to the SSH server from you
program then you need to add a tcp server that will listen to specific
door and forward all the requests to the SSH server. The connection
string for you database application must be changed to
localhost:yourPort in order to be forward to the SSH server.

----------------------------------------------------------------------
snorkel · 2012-09-14 17:31

Don't want to use Cryptlib as the license is pretty restrictive.
I guess I could just wait for SecureBridge from devart.com to be
ported to Lazarus as that's what I use in Delphi, who knows how long
that could take.

Apparently libssh2 has a api command you call and it handles part of
the data transfer or it tells the SSH server where to forward the data
to.
not really sure as all the docs are geared for C/C++ which I have not
used in 22 years :-(

----------------------------------------------------------------------
ludob · 2012-09-14 17:45

See http://forum.lazarus.freepascal.org/index.php/topic,18193.0.html
for the use of libssh2 with synapse.