---
product: Chilkat
product_version: 11.7.0
language: pascal
language_label: Lazarus Pascal
class: SshTunnel
license: bundle
deprecated: false
reference_html: https://www.chilkatsoft.com/refdoc/pascal_SshTunnelRef.html
---
# Chilkat SshTunnel — Lazarus Pascal — v11.7.0

> Chilkat 11.7.0 · language=pascal · class=SshTunnel
> Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0/<lang>/classes/SshTunnel.md`.
> Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/guide.md`.

## Purpose

**Create SSH tunnels for secure local, fixed-destination, dynamic, and multi-hop forwarding.**

`Chilkat.SshTunnel` creates SSH tunnels for forwarding local client connections through an SSH server to a destination service, such as a database server or other TCP service. It supports fixed destination forwarding, dynamic SOCKS-style port forwarding, password and public-key authentication, keyboard-interactive authentication, proxy connections to the SSH server, multi-hop SSH connections, background accept threads, tunnel/client logging, secure secret lookup, and connection diagnostics.

**Local port forwarding**

Listen on a local port and forward accepted client connections through an SSH server to a configured destination host and port.

**Dynamic forwarding**

Enable SOCKS-style dynamic port forwarding when each client connection should choose its own destination through the tunnel.

**SSH authentication**

Authenticate to the SSH server using passwords, public keys, password-plus-key, secure password lookup, or keyboard-interactive authentication.

**Proxy and multi-hop access**

Reach the SSH server through HTTP or SOCKS proxies, or build tunnels through an existing SSH connection for multi-hop scenarios.

**Accept and manage clients**

Start accepting client connections in the background, inspect current state, stop accepting new clients, and disconnect active tunnel clients.

**Logging and diagnostics**

Use accept logs, tunnel logs, current-state XML, and `LastErrorText` to troubleshoot SSH connection, forwarding, authentication, or client-connection problems.

**Common pattern:** Configure the SSH server, authentication method, local listen settings, and destination forwarding options, then call `BeginAccepting` to start the tunnel. Local client applications connect to the tunnel's listen port, and `SshTunnel` forwards the traffic through SSH. Use `Chilkat.SshTunnel` for port forwarding; use `Chilkat.Ssh` for direct SSH sessions, commands, channels, and shell access.

**Start with the SSH Tunneling Guide**

Learn how static forwarding, dynamic SOCKS forwarding, multi-hop tunneling, proxies, background threads, lifecycle management, and troubleshooting fit together.

[Open the SshTunnel Guide](https://www.chilkatsoft.com/sshtunnel_index.asp)

A shorter API-focused introduction is also available in the [SshTunnel Class Overview](https://www.chilkatsoft.com/sshtunnel_class_overview.asp).

## Object creation, unlocking and error handling

**Create / Free**

```pascal
uses
  Chilkat.SshTunnel;

var
  obj: TSshTunnel;
begin
  obj := TSshTunnel.Create;
  try
    if not obj.IsValid then
      raise Exception.Create('Failed to create a TSshTunnel instance.');

    // ... use obj ...

  finally
    obj.Free;
  end;
end;
```

`constructor Create;`

Allocates the underlying CkSshTunnel object and returns a new TSshTunnel instance. Simply adding **Chilkat.SshTunnel** to the unit's `uses` clause is enough to locate and bind to the Chilkat shared library (DLL / .so / .dylib) at runtime — no separate load step is required. Check `obj.IsValid` after calling `Create`; it is `False` if the underlying library could not be found/loaded or the object could not be allocated (for example, when unlicensed).

`destructor Destroy; override;`

Every TSshTunnel created by calling `Create` should eventually be released by calling `.Free` (inherited from `TObject`). The destructor automatically disposes the underlying CkSshTunnel handle. A native (unmanaged) memory leak occurs if the object is never freed.

Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Lazarus Pascal.

## Members common to every Chilkat class

Documented once per language in `common-members.md`; listed here so this page is self-contained.

| Property | Signature | Access | Meaning |
|---|---|---|---|
| `DebugLogFilePath` | `property DebugLogFilePath: string read GetDebugLogFilePath write SetDebugLogFilePath;` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. |
| `LastErrorHtml` | `property LastErrorHtml: string read GetLastErrorHtml;` | read-only | Provides HTML-formatted information about the last called method or property. |
| `LastErrorText` | `property LastErrorText: string read GetLastErrorText;` | read-only | Provides plain text information about the last called method or property. |
| `LastErrorXml` | `property LastErrorXml: string read GetLastErrorXml;` | read-only | Provides XML-formatted information about the last called method or property. |
| `LastMethodSuccess` | `property LastMethodSuccess: Boolean read GetLastMethodSuccess write SetLastMethodSuccess;` | read/write | Indicates the success or failure of the most recent method call: `True` means success, `False` means failure. |
| `VerboseLogging` | `property VerboseLogging: Boolean read GetVerboseLogging write SetVerboseLogging;` | read/write | If set to `True`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. |
| `Version` | `property Version: string read GetVersion;` | read-only | Version of the component/library, such as "10.1.0" |

## Member index

| Member | Kind | Signature |
|---|---|---|
| `AbortCurrent` | property, read/write | `property AbortCurrent: Boolean read GetAbortCurrent write SetAbortCurrent;` |
| `AcceptLog` | property, read/write | `property AcceptLog: string read GetAcceptLog write SetAcceptLog;` |
| `AcceptLogPath` | property, read/write | `property AcceptLogPath: string read GetAcceptLogPath write SetAcceptLogPath;` |
| `ClientIdentifier` | property, read/write | `property ClientIdentifier: string read GetClientIdentifier write SetClientIdentifier;` |
| `ClientLogDir` | property, read/write | `property ClientLogDir: string read GetClientLogDir write SetClientLogDir;` |
| `ConnectTimeoutMs` | property, read/write | `property ConnectTimeoutMs: Integer read GetConnectTimeoutMs write SetConnectTimeoutMs;` |
| `DestHostname` | property, read/write | `property DestHostname: string read GetDestHostname write SetDestHostname;` |
| `DestPort` | property, read/write | `property DestPort: Integer read GetDestPort write SetDestPort;` |
| `DynamicPortForwarding` | property, read/write | `property DynamicPortForwarding: Boolean read GetDynamicPortForwarding write SetDynamicPortForwarding;` |
| `EnableSecrets` | property, read/write | `property EnableSecrets: Boolean read GetEnableSecrets write SetEnableSecrets;` |
| `HostKeyFingerprint` | property, read-only | `property HostKeyFingerprint: string read GetHostKeyFingerprint;` |
| `HttpProxyAuthMethod` | property, read/write | `property HttpProxyAuthMethod: string read GetHttpProxyAuthMethod write SetHttpProxyAuthMethod;` |
| `HttpProxyDomain` | property, read/write | `property HttpProxyDomain: string read GetHttpProxyDomain write SetHttpProxyDomain;` |
| `HttpProxyHostname` | property, read/write | `property HttpProxyHostname: string read GetHttpProxyHostname write SetHttpProxyHostname;` |
| `HttpProxyPassword` | property, read/write | `property HttpProxyPassword: string read GetHttpProxyPassword write SetHttpProxyPassword;` |
| `HttpProxyPort` | property, read/write | `property HttpProxyPort: Integer read GetHttpProxyPort write SetHttpProxyPort;` |
| `HttpProxyUsername` | property, read/write | `property HttpProxyUsername: string read GetHttpProxyUsername write SetHttpProxyUsername;` |
| `IdleTimeoutMs` | property, read/write | `property IdleTimeoutMs: Integer read GetIdleTimeoutMs write SetIdleTimeoutMs;` |
| `InboundSocksPassword` | property, read/write | `property InboundSocksPassword: string read GetInboundSocksPassword write SetInboundSocksPassword;` |
| `InboundSocksUsername` | property, read/write | `property InboundSocksUsername: string read GetInboundSocksUsername write SetInboundSocksUsername;` |
| `IsAccepting` | property, read-only | `property IsAccepting: Boolean read GetIsAccepting;` |
| `KeepAcceptLog` | property, read/write | `property KeepAcceptLog: Boolean read GetKeepAcceptLog write SetKeepAcceptLog;` |
| `KeepTunnelLog` | property, read/write | `property KeepTunnelLog: Boolean read GetKeepTunnelLog write SetKeepTunnelLog;` |
| `ListenBindIpAddress` | property, read/write | `property ListenBindIpAddress: string read GetListenBindIpAddress write SetListenBindIpAddress;` |
| `ListenPort` | property, read-only | `property ListenPort: Integer read GetListenPort;` |
| `OutboundBindIpAddress` | property, read/write | `property OutboundBindIpAddress: string read GetOutboundBindIpAddress write SetOutboundBindIpAddress;` |
| `OutboundBindPort` | property, read/write | `property OutboundBindPort: Integer read GetOutboundBindPort write SetOutboundBindPort;` |
| `PreferIpv6` | property, read/write | `property PreferIpv6: Boolean read GetPreferIpv6 write SetPreferIpv6;` |
| `SocksHostname` | property, read/write | `property SocksHostname: string read GetSocksHostname write SetSocksHostname;` |
| `SocksPassword` | property, read/write | `property SocksPassword: string read GetSocksPassword write SetSocksPassword;` |
| `SocksPort` | property, read/write | `property SocksPort: Integer read GetSocksPort write SetSocksPort;` |
| `SocksUsername` | property, read/write | `property SocksUsername: string read GetSocksUsername write SetSocksUsername;` |
| `SocksVersion` | property, read/write | `property SocksVersion: Integer read GetSocksVersion write SetSocksVersion;` |
| `SoRcvBuf` | property, read/write | `property SoRcvBuf: Integer read GetSoRcvBuf write SetSoRcvBuf;` |
| `SoSndBuf` | property, read/write | `property SoSndBuf: Integer read GetSoSndBuf write SetSoSndBuf;` |
| `TcpNoDelay` | property, read/write | `property TcpNoDelay: Boolean read GetTcpNoDelay write SetTcpNoDelay;` |
| `TunnelLog` | property, read/write | `property TunnelLog: string read GetTunnelLog write SetTunnelLog;` |
| `TunnelLogPath` | property, read/write | `property TunnelLogPath: string read GetTunnelLogPath write SetTunnelLogPath;` |
| `UncommonOptions` | property, read/write | `property UncommonOptions: string read GetUncommonOptions write SetUncommonOptions;` |
| `AuthenticatePk` | method | `// privateKey is a TSshKey object. function AuthenticatePk(const username: string;     privateKey: TChilkatBase): Boolean;` |
| `AuthenticatePw` | method | `function AuthenticatePw(const login: string;     const password: string): Boolean;` |
| `AuthenticatePwPk` | method | `// privateKey is a TSshKey object. function AuthenticatePwPk(const username: string;     const password: string;     privateKey: TChilkatBase): Boolean;` |
| `AuthenticateSecPw` | method | `// login is a TSecureString object. // password is a TSecureString object. function AuthenticateSecPw(login: TChilkatBase;     password: TChilkatBase): Boolean;` |
| `AuthenticateSecPwPk` | method | `// username is a TSecureString object. // password is a TSecureString object. // privateKey is a TSshKey object. function AuthenticateSecPwPk(username: TChilkatBase;     password: TChilkatBase;     privateKey: TChilkatBase): Boolean;` |
| `BeginAccepting` | method | `function BeginAccepting(listenPort: Integer): Boolean;` |
| `CloseTunnel` | method | `function CloseTunnel(waitForThreads: Boolean): Boolean;` |
| `Connect` | method | `function Connect(const hostname: string;     port: Integer): Boolean;` |
| `ConnectThroughSsh` | method | `// ssh is a TSsh object. function ConnectThroughSsh(ssh: TChilkatBase;     const hostname: string;     port: Integer): Boolean;` |
| `ContinueKeyboardAuth` | method | `function ContinueKeyboardAuth(const response: string): string;` |
| `DisconnectAllClients` | method | `function DisconnectAllClients(waitForThreads: Boolean): Boolean;` |
| `GetCurrentState` | method | `function GetCurrentState: string;` |
| `IsSshConnected` | method | `function IsSshConnected: Boolean;` |
| `LoadTaskCaller` | method | `// task is a TTask object. function LoadTaskCaller(task: TChilkatBase): Boolean;` |
| `SetAllowedAlgorithms` | method | `// json is a TJsonObject object. function SetAllowedAlgorithms(json: TChilkatBase): Boolean;` |
| `StartKeyboardAuth` | method | `function StartKeyboardAuth(const login: string): string;` |
| `StopAccepting` | method | `function StopAccepting(waitForThread: Boolean): Boolean;` |

## Properties

### SshTunnel.AbortCurrent

`Chilkat 11.7.0 · pascal · SshTunnel · AbortCurrent · property · read/write · since 9.5.0.58`

```pascal
property AbortCurrent: Boolean read GetAbortCurrent write SetAbortCurrent;
```

Set this property to `True` from another thread to request that the currently running foreground operation be aborted. For example, it can interrupt a synchronous `Connect` that is waiting for an SSH server response.

This property does not stop the background listener or terminate established background tunnel clients.

Do not assume the property is automatically reset after an operation is aborted. It may remain `True`; set it back to `False` before starting another operation.

### SshTunnel.AcceptLog

`Chilkat 11.7.0 · pascal · SshTunnel · AcceptLog · property · read/write`

```pascal
property AcceptLog: string read GetAcceptLog write SetAcceptLog;
```

Contains the in-memory activity log for the background listener thread started by `BeginAccepting`.

The log is populated only when `KeepAcceptLog` is `True`.

### SshTunnel.AcceptLogPath

`Chilkat 11.7.0 · pascal · SshTunnel · AcceptLogPath · property · read/write · since 9.5.0.50`

```pascal
property AcceptLogPath: string read GetAcceptLogPath write SetAcceptLogPath;
```

Specifies the local file path where activity from the background listener thread is written.

This file-based log is separate from the in-memory `AcceptLog`.

### SshTunnel.ClientIdentifier

`Chilkat 11.7.0 · pascal · SshTunnel · ClientIdentifier · property · read/write · since 9.5.0.95`

```pascal
property ClientIdentifier: string read GetClientIdentifier write SetClientIdentifier;
```

Specifies the SSH client-identification string sent when connecting to the SSH server.

Starting in Chilkat v9.5.0.99, the default is `SSH-2.0-Chilkat_` followed by the Chilkat version number, such as `SSH-2.0-Chilkat_9.5.0.99`.

The identifier should begin with `SSH-2.0-`. Some SSH servers disconnect clients that send an invalid identification string.

### SshTunnel.ClientLogDir

`Chilkat 11.7.0 · pascal · SshTunnel · ClientLogDir · property · read/write · since 11.1.0`

```pascal
property ClientLogDir: string read GetClientLogDir write SetClientLogDir;
```

Specifies the local directory where a separate log file is created for each tunnel client.

When this property is not empty, files are named using the pattern `tunnel_client_log_{random_id}.txt`.

### SshTunnel.ConnectTimeoutMs

`Chilkat 11.7.0 · pascal · SshTunnel · ConnectTimeoutMs · property · read/write`

```pascal
property ConnectTimeoutMs: Integer read GetConnectTimeoutMs write SetConnectTimeoutMs;
```

Specifies the maximum number of milliseconds allowed for establishing the SSH connection.

- The default value is `30000` milliseconds (30 seconds).
- A value of `0` disables the connection timeout and allows an unlimited wait.

The timeout applies to more than the initial TCP connection. It also covers connection setup performed through an HTTP or SOCKS proxy and waiting for the SSH server identification string after the TCP connection has been established.

### SshTunnel.DestHostname

`Chilkat 11.7.0 · pascal · SshTunnel · DestHostname · property · read/write`

```pascal
property DestHostname: string read GetDestHostname write SetDestHostname;
```

Specifies the destination hostname or IP address for fixed-destination port forwarding. This is typically the host running the database server or other TCP service that local clients need to reach.

The destination is interpreted from the SSH server's network environment. For example, `localhost` and `127.0.0.1` refer to the SSH server itself, not the computer running the application. Hostname resolution is therefore performed as part of the forwarding request on the SSH-server side.

Traffic accepted by the local listener is carried through SSH, forwarded by the SSH server to this destination, and returned through the same tunnel.

This property is ignored when `DynamicPortForwarding` is `True`. Changing the destination while the listener is running affects new clients only; existing clients remain connected to the destination selected when they were accepted.

### SshTunnel.DestPort

`Chilkat 11.7.0 · pascal · SshTunnel · DestPort · property · read/write`

```pascal
property DestPort: Integer read GetDestPort write SetDestPort;
```

Specifies the TCP port of the destination service used for fixed-destination forwarding, such as the port of a database server.

It is used together with `DestHostname` and is ignored when `DynamicPortForwarding` is `True`.

### SshTunnel.DynamicPortForwarding

`Chilkat 11.7.0 · pascal · SshTunnel · DynamicPortForwarding · property · read/write · since 9.5.0.50`

```pascal
property DynamicPortForwarding: Boolean read GetDynamicPortForwarding write SetDynamicPortForwarding;
```

Controls whether the listener performs fixed-destination or dynamic port forwarding.

- When `False` (the default), every accepted connection is forwarded to `DestHostname` and `DestPort`.
- When `True`, the listener acts as a SOCKS proxy and each inbound client supplies its own destination.

The SOCKS version is detected independently from each inbound client handshake; there is no separate inbound SOCKS-version property. SOCKS4 and SOCKS5 `CONNECT` requests are supported. SOCKS5 `BIND` and UDP association are not supported.

Leave `InboundSocksUsername` empty to allow SOCKS5 clients to use the no-authentication method. Set the inbound username and password to require SOCKS5 username/password authentication. For SOCKS4, only the user ID can be checked because SOCKS4 has no password field.

SOCKS4a hostname-form requests are not supported. Use a numeric IPv4 address with SOCKS4, or use SOCKS5 when the client needs to supply a domain name.

### SshTunnel.EnableSecrets

`Chilkat 11.7.0 · pascal · SshTunnel · EnableSecrets · property · read/write · since 11.5.0`

```pascal
property EnableSecrets: Boolean read GetEnableSecrets write SetEnableSecrets;
```

**Full documentation for this property (same in every language):** [More Detailed Information About EnableSecrets](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/secret_specification_strings.md)

Enables automatic resolution of credentials from secure storage provided by the operating system.

When set to `True`, supported password properties and methods may receive a **secret specification string** beginning with `!!` instead of a literal password. Chilkat resolves the secret from:

- Windows Credential Manager on Windows.
- Apple Keychain on macOS.

The specification format is: `!![appName|]service[|domain]|username`

This applies to `HttpProxyPassword`, `SocksPassword`, `AuthenticatePw`, and `AuthenticatePwPk`.

The default value is `False`.

### SshTunnel.HostKeyFingerprint

`Chilkat 11.7.0 · pascal · SshTunnel · HostKeyFingerprint · property · read-only · since 9.5.0.56`

```pascal
property HostKeyFingerprint: string read GetHostKeyFingerprint;
```

Contains the SSH server host-key fingerprint after `Connect` or `ConnectThroughSsh` establishes the SSH connection. The value is available before user authentication.

Example: `ssh-ed25519 256 e0:33:b1:81:a5:c6:9a:d2:2e:c9:d3:15:60:ea:cf:4c`

Compare this value with a trusted expected fingerprint to verify the identity of the SSH server. For `ConnectThroughSsh`, the fingerprint is for the final SSH server, not the first-hop server.

The value may remain populated after `CloseTunnel` or after the connection is lost. Use `IsSshConnected` to determine current connection state.

### SshTunnel.HttpProxyAuthMethod

`Chilkat 11.7.0 · pascal · SshTunnel · HttpProxyAuthMethod · property · read/write`

```pascal
property HttpProxyAuthMethod: string read GetHttpProxyAuthMethod write SetHttpProxyAuthMethod;
```

Specifies the authentication method to use when the outbound connection to the SSH server passes through an HTTP proxy that requires authentication.

Valid values are `Basic` and `NTLM`.

If `SocksVersion` is set to `4` or `5`, the SOCKS proxy takes precedence and these HTTP proxy settings are ignored. The proxies are not chained.

### SshTunnel.HttpProxyDomain

`Chilkat 11.7.0 · pascal · SshTunnel · HttpProxyDomain · property · read/write`

```pascal
property HttpProxyDomain: string read GetHttpProxyDomain write SetHttpProxyDomain;
```

Specifies the optional Windows domain used for NTLM authentication with the HTTP proxy.

This applies only to the outbound proxy connection used to reach the SSH server, and only when `HttpProxyAuthMethod` is `NTLM`.

If `SocksVersion` is set to `4` or `5`, the SOCKS proxy takes precedence and these HTTP proxy settings are ignored. The proxies are not chained.

### SshTunnel.HttpProxyHostname

`Chilkat 11.7.0 · pascal · SshTunnel · HttpProxyHostname · property · read/write`

```pascal
property HttpProxyHostname: string read GetHttpProxyHostname write SetHttpProxyHostname;
```

Specifies the hostname or IPv4 address of the HTTP proxy through which the outbound connection to the SSH server is made.

Leave this property empty when no HTTP proxy is required.

If `SocksVersion` is set to `4` or `5`, the SOCKS proxy takes precedence and these HTTP proxy settings are ignored. The proxies are not chained.

### SshTunnel.HttpProxyPassword

`Chilkat 11.7.0 · pascal · SshTunnel · HttpProxyPassword · property · read/write`

```pascal
property HttpProxyPassword: string read GetHttpProxyPassword write SetHttpProxyPassword;
```

Specifies the password used to authenticate with the HTTP proxy for the outbound connection to the SSH server.

If `SocksVersion` is set to `4` or `5`, the SOCKS proxy takes precedence and these HTTP proxy settings are ignored. The proxies are not chained.

### SshTunnel.HttpProxyPort

`Chilkat 11.7.0 · pascal · SshTunnel · HttpProxyPort · property · read/write`

```pascal
property HttpProxyPort: Integer read GetHttpProxyPort write SetHttpProxyPort;
```

Specifies the TCP port of the HTTP proxy used for the outbound connection to the SSH server.

Common HTTP proxy ports include `8080` and `3128`.

If `SocksVersion` is set to `4` or `5`, the SOCKS proxy takes precedence and these HTTP proxy settings are ignored. The proxies are not chained.

### SshTunnel.HttpProxyUsername

`Chilkat 11.7.0 · pascal · SshTunnel · HttpProxyUsername · property · read/write`

```pascal
property HttpProxyUsername: string read GetHttpProxyUsername write SetHttpProxyUsername;
```

Specifies the username used to authenticate with the HTTP proxy for the outbound connection to the SSH server.

If `SocksVersion` is set to `4` or `5`, the SOCKS proxy takes precedence and these HTTP proxy settings are ignored. The proxies are not chained.

### SshTunnel.IdleTimeoutMs

`Chilkat 11.7.0 · pascal · SshTunnel · IdleTimeoutMs · property · read/write`

```pascal
property IdleTimeoutMs: Integer read GetIdleTimeoutMs write SetIdleTimeoutMs;
```

Specifies a stall timeout, in milliseconds, for tunnel data-transfer operations. The default value is `30000` milliseconds (30 seconds). A value of `0` disables the timeout.

This property is not a general inactivity timer for established background tunnel clients. An otherwise idle client, or a client with data queued while an SSH channel is flow-controlled, may remain connected beyond this interval. Applications should not rely on this property to disconnect clients merely because no application data is flowing.

### SshTunnel.InboundSocksPassword

`Chilkat 11.7.0 · pascal · SshTunnel · InboundSocksPassword · property · read/write · since 9.5.0.50`

```pascal
property InboundSocksPassword: string read GetInboundSocksPassword write SetInboundSocksPassword;
```

Specifies the password required from inbound SOCKS5 clients when `DynamicPortForwarding` is `True`.

This property is used together with `InboundSocksUsername`. It does not apply to SOCKS4 because the SOCKS4 protocol has no password field.

### SshTunnel.InboundSocksUsername

`Chilkat 11.7.0 · pascal · SshTunnel · InboundSocksUsername · property · read/write · since 9.5.0.50`

```pascal
property InboundSocksUsername: string read GetInboundSocksUsername write SetInboundSocksUsername;
```

Specifies the username required from inbound SOCKS clients when `DynamicPortForwarding` is `True`.

- For SOCKS5, setting this property enables username/password authentication.
- For SOCKS4, the value is compared with the client-supplied user ID.
- Leave it empty to require no inbound SOCKS username.

### SshTunnel.IsAccepting

`Chilkat 11.7.0 · pascal · SshTunnel · IsAccepting · property · read-only`

```pascal
property IsAccepting: Boolean read GetIsAccepting;
```

`True` when the local listener thread is running and accepting inbound TCP connections; otherwise `False`.

This property describes only the local listener. It can remain `True` after the SSH connection is lost or after `CloseTunnel` is called. In those states a client may connect to the local port even though its traffic cannot be forwarded.

Use `IsSshConnected` separately when the application also needs to know whether the SSH transport is available.

### SshTunnel.KeepAcceptLog

`Chilkat 11.7.0 · pascal · SshTunnel · KeepAcceptLog · property · read/write`

```pascal
property KeepAcceptLog: Boolean read GetKeepAcceptLog write SetKeepAcceptLog;
```

Controls whether activity from the background listener thread is retained in memory.

The default value is `False`. When enabled, retrieve the log from `AcceptLog`.

### SshTunnel.KeepTunnelLog

`Chilkat 11.7.0 · pascal · SshTunnel · KeepTunnelLog · property · read/write · since 9.5.0.50`

```pascal
property KeepTunnelLog: Boolean read GetKeepTunnelLog write SetKeepTunnelLog;
```

Controls whether SSH tunnel-thread activity is retained in memory.

The default value is `False`. When enabled, retrieve the log from `TunnelLog`.

### SshTunnel.ListenBindIpAddress

`Chilkat 11.7.0 · pascal · SshTunnel · ListenBindIpAddress · property · read/write`

```pascal
property ListenBindIpAddress: string read GetListenBindIpAddress write SetListenBindIpAddress;
```

Specifies the local IPv4 address to which the tunnel's listening socket is bound.

| Value | Listener exposure |
| :--- | :--- |
| Empty string | Binds to `0.0.0.0` and accepts connections on all local IPv4 interfaces, subject to firewall rules. |
| `127.0.0.1` | Accepts connections only from the local computer through loopback. |
| A specific local LAN address | Accepts connections through that interface only; loopback is not included automatically. |

For a tunnel intended only for local applications, explicitly set this property to `127.0.0.1`. Leaving it empty may expose the listening port to other computers on the network.

If the value is malformed or is not assigned to a local interface, `BeginAccepting` returns `False` and the bind failure is available in `LastErrorText` and the accept log.

### SshTunnel.ListenPort

`Chilkat 11.7.0 · pascal · SshTunnel · ListenPort · property · read-only`

```pascal
property ListenPort: Integer read GetListenPort;
```

Contains the local TCP port used by the listener started by `BeginAccepting`.

- If `BeginAccepting` succeeds with a nonzero requested port, this property contains that port.
- If `BeginAccepting` succeeds with `0`, the operating system chooses an available port and this property contains the allocated port when the method returns.
- After a bind failure for an explicitly requested port, this property may still contain the requested port even though `IsAccepting` is `False`.
- The value is initially `0`.

### SshTunnel.OutboundBindIpAddress

`Chilkat 11.7.0 · pascal · SshTunnel · OutboundBindIpAddress · property · read/write`

```pascal
property OutboundBindIpAddress: string read GetOutboundBindIpAddress write SetOutboundBindIpAddress;
```

Specifies the local IP address to which the outbound socket is bound before connecting to the SSH server.

Most applications should leave this property empty. Set it only on a multihomed computer when the SSH connection must originate from a specific local network interface or IP address.

### SshTunnel.OutboundBindPort

`Chilkat 11.7.0 · pascal · SshTunnel · OutboundBindPort · property · read/write`

```pascal
property OutboundBindPort: Integer read GetOutboundBindPort write SetOutboundBindPort;
```

Specifies the local TCP port to bind before making the outbound connection to the SSH server.

The default value is `0`, which allows the operating system to choose an available ephemeral port. Nearly all applications should leave this property unchanged.

### SshTunnel.PreferIpv6

`Chilkat 11.7.0 · pascal · SshTunnel · PreferIpv6 · property · read/write · since 9.5.0.70`

```pascal
property PreferIpv6: Boolean read GetPreferIpv6 write SetPreferIpv6;
```

Controls which IP version is preferred when a hostname resolves to both IPv4 and IPv6 addresses.

- `False` (the default) prefers IPv4.
- `True` prefers IPv6.

### SshTunnel.SocksHostname

`Chilkat 11.7.0 · pascal · SshTunnel · SocksHostname · property · read/write`

```pascal
property SocksHostname: string read GetSocksHostname write SetSocksHostname;
```

Specifies the hostname or IPv4 address of the outbound SOCKS4 or SOCKS5 proxy used to reach the SSH server.

This property is used only when `SocksVersion` is `4` or `5`.

### SshTunnel.SocksPassword

`Chilkat 11.7.0 · pascal · SshTunnel · SocksPassword · property · read/write`

```pascal
property SocksPassword: string read GetSocksPassword write SetSocksPassword;
```

Specifies the password for authenticating with an outbound SOCKS5 proxy used to reach the SSH server.

SOCKS4 does not support password authentication, so this property does not apply when `SocksVersion` is `4`.

### SshTunnel.SocksPort

`Chilkat 11.7.0 · pascal · SshTunnel · SocksPort · property · read/write`

```pascal
property SocksPort: Integer read GetSocksPort write SetSocksPort;
```

Specifies the TCP port of the outbound SOCKS4 or SOCKS5 proxy used to reach the SSH server.

The default value is `1080`. This property is used only when `SocksVersion` is `4` or `5`.

### SshTunnel.SocksUsername

`Chilkat 11.7.0 · pascal · SshTunnel · SocksUsername · property · read/write`

```pascal
property SocksUsername: string read GetSocksUsername write SetSocksUsername;
```

Specifies the username for the outbound SOCKS4 or SOCKS5 proxy used to reach the SSH server.

This property is used only when `SocksVersion` is `4` or `5`.

### SshTunnel.SocksVersion

`Chilkat 11.7.0 · pascal · SshTunnel · SocksVersion · property · read/write`

```pascal
property SocksVersion: Integer read GetSocksVersion write SetSocksVersion;
```

Selects whether the outbound connection to the SSH server is made through a SOCKS proxy.

| Value | Behavior |
| :--- | :--- |
| `0` | Do not use a SOCKS proxy. This is the default. |
| `4` | Connect through a SOCKS4 proxy. |
| `5` | Connect through a SOCKS5 proxy. |

When this property is `4` or `5`, the SOCKS proxy settings take precedence over the HTTP proxy settings. The SOCKS and HTTP proxies are not chained.

### SshTunnel.SoRcvBuf

`Chilkat 11.7.0 · pascal · SshTunnel · SoRcvBuf · property · read/write`

```pascal
property SoRcvBuf: Integer read GetSoRcvBuf write SetSoRcvBuf;
```

Sets the receive-buffer size for the underlying TCP socket.

The default value is `4194304` bytes. Normally this property should remain unchanged. If receive performance is unusually slow, testing a larger value that is a multiple of `4096` may help.

See also:

- [More Information about TCP performance and Buffer Sizes](http://www.cknotes.com/?p=446)

### SshTunnel.SoSndBuf

`Chilkat 11.7.0 · pascal · SshTunnel · SoSndBuf · property · read/write`

```pascal
property SoSndBuf: Integer read GetSoSndBuf write SetSoSndBuf;
```

Sets the send-buffer size for the underlying TCP socket.

The default value is `262144` bytes. Normally this property should remain unchanged. If send performance is unusually slow, testing values such as `524288` or `1048576` may help. A multiple of `4096` is recommended.

See also:

- [More Information about TCP performance and Buffer Sizes](http://www.cknotes.com/?p=446)

### SshTunnel.TcpNoDelay

`Chilkat 11.7.0 · pascal · SshTunnel · TcpNoDelay · property · read/write`

```pascal
property TcpNoDelay: Boolean read GetTcpNoDelay write SetTcpNoDelay;
```

Controls the `TCP_NODELAY` socket option for the underlying TCP connection.

The default value is `False`. Setting it to `True` disables the Nagle algorithm, which can reduce latency when many small amounts of data are sent.

### SshTunnel.TunnelLog

`Chilkat 11.7.0 · pascal · SshTunnel · TunnelLog · property · read/write · since 9.5.0.50`

```pascal
property TunnelLog: string read GetTunnelLog write SetTunnelLog;
```

Contains the in-memory activity log for the SSH tunnel and client-manager threads. The log is populated only when `KeepTunnelLog` is `True`.

Treat this log as sensitive diagnostic data. It can contain hostnames, ports, usernames, proxy details, SOCKS handshake information, and authentication failure values. Do not publish or persist it without reviewing and protecting its contents.

### SshTunnel.TunnelLogPath

`Chilkat 11.7.0 · pascal · SshTunnel · TunnelLogPath · property · read/write · since 9.5.0.50`

```pascal
property TunnelLogPath: string read GetTunnelLogPath write SetTunnelLogPath;
```

Specifies the local file path where SSH tunnel-thread activity is written.

This file-based log is separate from the in-memory `TunnelLog`.

### SshTunnel.UncommonOptions

`Chilkat 11.7.0 · pascal · SshTunnel · UncommonOptions · property · read/write · since 9.5.0.73`

```pascal
property UncommonOptions: string read GetUncommonOptions write SetUncommonOptions;
```

Provides optional behavior for uncommon requirements. The default value is an empty string, which is appropriate for most applications.

To enable more than one option, provide a comma-separated list of keywords.

| Keyword | Effect |
| :--- | :--- |
| `ForceUserAuthRsaSha1` | Forces `rsa-sha1` for public-key user authentication. Set this before connecting. Added in v9.5.0.98. |
| `NoKeepAliveIgnoreMsg` | Disables the default SSH `ignore` message sent every 20 seconds to keep an idle connection alive. Added in v9.5.0.76. |
| `no-weak-mac-algs` | Removes `hmac-sha1-96`, `hmac-sha1`, `hmac-md5`, and `hmac-ripemd160` from the offered MAC algorithms. Added in v9.5.0.98. |
| `ProtectFromVpn` | On Android, bypasses an installed or active VPN. Added in v9.5.0.80. |
| `+ssh-hmac-etm` | Re-enables SSH encrypt-then-MAC algorithms that were disabled by default in v9.5.0.97 as part of the Terrapin mitigation. |
| `+chacha20-poly1305@openssh.com` | Re-enables `chacha20-poly1305@openssh.com`, which was removed from the default offer in v9.5.0.97 as part of the Terrapin mitigation. |

## Methods

### SshTunnel.AuthenticatePk

`Chilkat 11.7.0 · pascal · SshTunnel · AuthenticatePk · method · since 9.5.0.50`

```pascal
// privateKey is a TSshKey object.

function  AuthenticatePk(const username: string;
    privateKey: TChilkatBase): Boolean;
```

Authenticates with the SSH server using public-key authentication.

The public key corresponding to `privateKey` must already be installed for `username` on the SSH server.

Call `Connect` or `ConnectThroughSsh` before calling this method.

When requesting support for an authentication failure, include the complete `LastErrorText`.

Returns True for success, False for failure.

See also:

- [Beware of too much time between connect and authentication.](http://www.cknotes.com/?p=278)

### SshTunnel.AuthenticatePw

`Chilkat 11.7.0 · pascal · SshTunnel · AuthenticatePw · method · since 9.5.0.50`

```pascal
function  AuthenticatePw(const login: string;
    const password: string): Boolean;
```

Authenticates with the SSH server using `login` and `password`.

Establish the SSH connection first by calling `Connect` or `ConnectThroughSsh`. After authentication succeeds, call `BeginAccepting` to begin accepting tunnel clients.

- A rejected username or password does not close the SSH connection; the application may correct the credentials and call this method again.
- Calling this method again after authentication has already succeeded returns `False` with an “Already authenticated” error.

When requesting support for an authentication failure, include the complete `LastErrorText` captured immediately after the failed call.

Returns True for success, False for failure.

See also:

- [Beware of too much time between connect and authentication.](http://www.cknotes.com/?p=278)

### SshTunnel.AuthenticatePwPk

`Chilkat 11.7.0 · pascal · SshTunnel · AuthenticatePwPk · method · since 9.5.0.50`

```pascal
// privateKey is a TSshKey object.

function  AuthenticatePwPk(const username: string;
    const password: string;
    privateKey: TChilkatBase): Boolean;
```

Authenticates with an SSH server that requires both a password and a private key.

The public key corresponding to `privateKey` must already be installed for `username` on the SSH server. Most SSH servers require either password authentication or public-key authentication rather than both.

When requesting support for an authentication failure, include the complete `LastErrorText`.

Returns True for success, False for failure.

### SshTunnel.AuthenticateSecPw

`Chilkat 11.7.0 · pascal · SshTunnel · AuthenticateSecPw · method · since 9.5.0.71`

```pascal
// login is a TSecureString object.

// password is a TSecureString object.

function  AuthenticateSecPw(login: TChilkatBase;
    password: TChilkatBase): Boolean;
```

Performs the same password authentication as `AuthenticatePw`, but receives the login and password in `SecureString` objects.

Returns True for success, False for failure.

### SshTunnel.AuthenticateSecPwPk

`Chilkat 11.7.0 · pascal · SshTunnel · AuthenticateSecPwPk · method · since 9.5.0.71`

```pascal
// username is a TSecureString object.

// password is a TSecureString object.

// privateKey is a TSshKey object.

function  AuthenticateSecPwPk(username: TChilkatBase;
    password: TChilkatBase;
    privateKey: TChilkatBase): Boolean;
```

Performs the same combined password-and-private-key authentication as `AuthenticatePwPk`, but receives the username and password in `SecureString` objects.

Returns True for success, False for failure.

### SshTunnel.BeginAccepting

`Chilkat 11.7.0 · pascal · SshTunnel · BeginAccepting · method`

```pascal
function  BeginAccepting(listenPort: Integer): Boolean;
```

Creates and starts the local listener on `listenPort`.

The SSH connection must already have been established. Although the listener can be started before user authentication, clients accepted in that state cannot be forwarded. The recommended sequence is to connect, authenticate, and then call this method.

- The requested port must not already be in use on the selected local interface.
- Pass `0` to let the operating system choose an available port, then read `ListenPort`.
- Calling this method while the listener is already running returns `False`.

The method waits for the initial bind-and-listen result. It returns `False` for errors such as an occupied port, a malformed bind address, or an address that is not assigned to the local computer. Details are available immediately in `LastErrorText` and, when enabled, the accept log.

A successful return means the listener was bound and started. No additional fixed delay is required merely to discover an initial bind failure.

Returns True for success, False for failure.

### SshTunnel.CloseTunnel

`Chilkat 11.7.0 · pascal · SshTunnel · CloseTunnel · method · since 9.5.0.50`

```pascal
function  CloseTunnel(waitForThreads: Boolean): Boolean;
```

Disconnects active tunnel clients and stops the tunnel-manager thread.

When `waitForThreads` is `True`, the method waits for the client and tunnel-manager threads to exit. It returns `False` if a worker thread does not stop; capture `LastErrorText` immediately for details.

This method does not stop the local listener and does not disconnect or reset the underlying SSH transport. Call `StopAccepting` separately to stop accepting local TCP connections. After this method returns, the listener may still accept a local connection even though the connection cannot be forwarded.

Calling this method more than once is allowed. However, it does not reset the object for a new call to `Connect`. Use a new `SshTunnel` object when connecting to a different SSH server.

Returns True for success, False for failure.

### SshTunnel.Connect

`Chilkat 11.7.0 · pascal · SshTunnel · Connect · method · since 9.5.0.50`

```pascal
function  Connect(const hostname: string;
    port: Integer): Boolean;
```

Establishes the SSH connection that will carry tunneled traffic. This method performs the TCP or proxy connection, the SSH protocol handshake, and host-key negotiation, but it does not authenticate the SSH user.

After connecting, verify `HostKeyFingerprint`, then authenticate by calling one of the `Authenticate*` methods. Finally, call `BeginAccepting` to start the local listener.

The host-key fingerprint is available immediately after this method succeeds, before user authentication. Calling `Connect` again while an SSH tunnel already exists returns `False`.

Chilkat sends an SSH `ignore` message every 20 seconds to help keep an unused SSH connection alive. To disable this behavior, add `NoKeepAliveIgnoreMsg` to `UncommonOptions` before connecting.

Returns True for success, False for failure.

### SshTunnel.ConnectThroughSsh

`Chilkat 11.7.0 · pascal · SshTunnel · ConnectThroughSsh · method · since 9.5.0.55`

```pascal
// ssh is a TSsh object.

function  ConnectThroughSsh(ssh: TChilkatBase;
    const hostname: string;
    port: Integer): Boolean;
```

Connects to a second SSH server through the existing connected and authenticated `Ssh` object supplied in `ssh`.

```
application -> first SSH server -> second SSH server
```

`hostname` and `port` identify the second SSH server. After this method succeeds, call an authentication method on this `SshTunnel` object to authenticate with the second server.

The supplied `Ssh` object is borrowed, not copied. It must remain alive, connected, and authenticated for as long as this tunnel is used. If the first-hop object is disconnected, existing forwarded clients stop working and new local connections cannot be forwarded. The local listener may nevertheless remain active until explicitly stopped.

`HostKeyFingerprint` reports the fingerprint of the second SSH server. After the connection is established, fixed forwarding destinations such as `127.0.0.1` are interpreted from the second server's network environment.

Returns True for success, False for failure.

### SshTunnel.ContinueKeyboardAuth

`Chilkat 11.7.0 · pascal · SshTunnel · ContinueKeyboardAuth · method · since 9.5.0.78`

```pascal
function  ContinueKeyboardAuth(const response: string): string;
```

Continues a keyboard-interactive authentication exchange started by `StartKeyboardAuth`.

If the server requested one response, pass that value directly in `response`. If it requested multiple responses, pass XML in the following form:

```
<response>
  <response1>response to first prompt</response1>
  <response2>response to second prompt</response2>
  ...
  <responseN>response to Nth prompt</responseN>
</response>
```

When authentication completes, the returned XML indicates success or failure:

```
<success>success message</success>

<error>error message</error>
```

If another challenge is required, the method returns another `infoRequest` XML document containing the next set of prompts.

Returns True for success, False for failure.

### SshTunnel.DisconnectAllClients

`Chilkat 11.7.0 · pascal · SshTunnel · DisconnectAllClients · method · since 9.5.0.50`

```pascal
function  DisconnectAllClients(waitForThreads: Boolean): Boolean;
```

Disconnects all active tunnel clients while leaving the local listener and SSH connection available.

When `waitForThreads` is `True`, the method waits for the current client threads to exit before returning. The listener continues accepting new clients, and newly accepted clients can be forwarded normally.

Returns True for success, False for failure.

### SshTunnel.GetCurrentState

`Chilkat 11.7.0 · pascal · SshTunnel · GetCurrentState · method · since 9.5.0.65`

```pascal
function  GetCurrentState: string;
```

Returns an XML snapshot describing the tunnel manager, SSH channels, and current tunnel clients. The returned data is intended for diagnostics and monitoring.

A typical result has the following structure:

```
<CurrentState>
  <tunnelManager rcvByteCount="433" sndByteCount="34"
      threadRunning="1" dynamicPortForwarding="0"
      staticDestHost="localhost" staticDestPort="18080">
    <openChannels count="1">
      <channel num="101" channelType="direct-tcpip"
          clientWinSize="2096927" serverWinSize="2097127" />
    </openChannels>
    <closedChannels count="0" />
  </tunnelManager>
  <clients count="1">
    <client destIp="localhost" destPort="18080"
        sshChannelNum="101" threadRunning="1"
        rcvByteCount="25" sndByteCount="225" />
  </clients>
</CurrentState>
```

The exact child elements can vary with state. For example, channel collections may be empty, and some transport details may be omitted before the tunnel is started or after it stops.

| Section | Information |
| :--- | :--- |
| `tunnelManager` | Aggregate byte counts, worker-thread state, forwarding mode, and configured fixed destination. |
| `openChannels` and `closedChannels` | SSH channel numbers, close/EOF flags, packet sizes, and flow-control window sizes. |
| `clients` | Per-client destination, SSH channel number, worker state, age/activity counters, pending-data flags, and byte counts. |

Returns True for success, False for failure.

### SshTunnel.IsSshConnected

`Chilkat 11.7.0 · pascal · SshTunnel · IsSshConnected · method · since 9.5.0.61`

```pascal
function  IsSshConnected: Boolean;
```

Returns `True` when the SSH transport used by this tunnel is connected; otherwise returns `False`.

This is independent of the local listener state. The listener may still be accepting local TCP connections when this method returns `False`, but those connections cannot be forwarded until a usable SSH transport exists.

For a tunnel created with `ConnectThroughSsh`, this method becomes `False` when the borrowed first-hop `Ssh` connection is disconnected.

### SshTunnel.LoadTaskCaller

`Chilkat 11.7.0 · pascal · SshTunnel · LoadTaskCaller · method · since 9.5.0.80`

```pascal
// task is a TTask object.

function  LoadTaskCaller(task: TChilkatBase): Boolean;
```

Loads this object with the `SshTunnel` instance that initiated the asynchronous operation represented by `task`.

Returns True for success, False for failure.

### SshTunnel.SetAllowedAlgorithms

`Chilkat 11.7.0 · pascal · SshTunnel · SetAllowedAlgorithms · method · since 9.5.0.99`

```pascal
// json is a TJsonObject object.

function  SetAllowedAlgorithms(json: TChilkatBase): Boolean;
```

Restricts the SSH connection to the algorithms specified in `json`.

This allows an application to define the exact algorithm set that may be used during SSH negotiation.

Returns True for success, False for failure.

### SshTunnel.StartKeyboardAuth

`Chilkat 11.7.0 · pascal · SshTunnel · StartKeyboardAuth · method · since 9.5.0.78`

```pascal
function  StartKeyboardAuth(const login: string): string;
```

Begins keyboard-interactive authentication for `login`.

When the server requests one or more responses, the returned XML contains the request name, instructions, and prompts:

```
<infoRequest numPrompts="N">
  <name>name text</name>
  <instruction>instruction text</instruction>
  <prompt1 echo="1_or_0">prompt text</prompt1>
  ...
  <promptN echo="1_or_0">prompt text</promptN>
</infoRequest>
```

The `echo` attribute indicates whether the response should be displayed while entered.

If authentication immediately succeeds or fails without requiring a response, the returned XML has one of these forms:

```
<success>success message</success>

<error>error message</error>
```

Pass the requested response or responses to `ContinueKeyboardAuth`.

Returns True for success, False for failure.

### SshTunnel.StopAccepting

`Chilkat 11.7.0 · pascal · SshTunnel · StopAccepting · method`

```pascal
function  StopAccepting(waitForThread: Boolean): Boolean;
```

Stops the local listener so that no new client connections are accepted. Existing forwarded clients remain connected and continue exchanging data.

- When `waitForThread` is `True`, the method waits for the listener thread to exit before returning.
- When it is `False`, shutdown is asynchronous and `IsAccepting` may remain `True` briefly after the method returns.

Call `BeginAccepting` again to resume accepting connections. The listener can be restarted on the same port after the previous listener has stopped.

Returns True for success, False for failure.

## Events and callbacks

Chilkat for Pascal supports three synchronous event callbacks: `OnAbortCheck`, `OnPercentDone`, and `OnProgressInfo`. Each is a property of the class; assign a method of one of your own objects (an *of object* handler) to receive the callbacks, or assign `nil` to unhook. The handler types are declared in the `Chilkat.Base` unit:

```pascal
TChilkatAbortCheckEvent   = function(Sender: TChilkatBase): Boolean of object;
TChilkatPercentDoneEvent  = function(Sender: TChilkatBase; PctDone: Integer): Boolean of object;
TChilkatProgressInfoEvent = procedure(Sender: TChilkatBase; const Name, Value: string) of object;
```

All Chilkat methods are synchronous, so callbacks are invoked on the thread that called the method -- if the method was called from the main thread, it is safe to access UI elements from the handler. The `HeartbeatMs` property controls the frequency of `OnAbortCheck` callbacks (the default of 0 means no AbortCheck events fire). Returning `True` from an `OnAbortCheck` or `OnPercentDone` handler aborts the running method.

### SshTunnel.AbortCheck (event)

`Chilkat 11.7.0 · pascal · SshTunnel · AbortCheck · event`

```pascal
// TChilkatAbortCheckEvent = function(Sender: TChilkatBase): Boolean of object;

property OnAbortCheck: TChilkatAbortCheckEvent;
```

Enables a method call to be aborted by triggering the AbortCheck event at intervals defined by the `HeartbeatMs` property. If HeartbeatMs is set to its default value of 0, no events will occur. For instance, set HeartbeatMs to 200 to trigger 5 AbortCheck events per second.

**Event callback implementation:**

```pascal
// A handler is a method of one of your own classes, e.g. a form:
function TMyObject.SshTunnelAbortCheck(Sender: TChilkatBase): Boolean;
begin
  // Called every HeartbeatMs milliseconds while a method is running.
  // Return True to abort the method; return False to continue.
  Result := False;
end;
```

**To add an event handler:**

```pascal
sshtunnel := TSshTunnel.Create;
sshtunnel.HeartbeatMs := 250;   // fire OnAbortCheck 4 times per second
sshtunnel.OnAbortCheck := MyObject.SshTunnelAbortCheck;
```

### SshTunnel.PercentDone (event)

`Chilkat 11.7.0 · pascal · SshTunnel · PercentDone · event`

```pascal
// TChilkatPercentDoneEvent = function(Sender: TChilkatBase; PctDone: Integer): Boolean of object;

property OnPercentDone: TChilkatPercentDoneEvent;
```

This provides the percentage completion for any method involving network communications or time-consuming processing, assuming the progress can be measured as a percentage. This event is triggered only when it's possible and logical to express the operation's progress as a percentage. The `pctDone` argument will range from 1 to 100. For methods that finish quickly, the number of PercentDone callbacks may vary, but the final callback will have `pctDone` equal to 100. For longer operations, callbacks will not exceed one per percentage point (e.g., 1, 2, 3, ..., 98, 99, 100).

The PercentDone callback also acts as an `AbortCheck` event. For fast methods where PercentDone fires, an AbortCheck event may not trigger since the PercentDone callback already provides an opportunity to abort. For longer operations, where time between PercentDone callbacks is extended, AbortCheck callbacks enable more responsive operation termination.

To abort the operation, set the `abort` output argument to `True`. This will cause the method to terminate and return a failure status or corresponding failure value.

**Event callback implementation:**

```pascal
// A handler is a method of one of your own classes, e.g. a form:
function TMyObject.SshTunnelPercentDone(Sender: TChilkatBase; PctDone: Integer): Boolean;
begin
  // PctDone ranges from 1 to 100.
  WriteLn('Percent done: ', PctDone);
  // Return True to abort the method; return False to continue.
  Result := False;
end;
```

**To add an event handler:**

```pascal
sshtunnel := TSshTunnel.Create;
sshtunnel.OnPercentDone := MyObject.SshTunnelPercentDone;
```

### SshTunnel.ProgressInfo (event)

`Chilkat 11.7.0 · pascal · SshTunnel · ProgressInfo · event`

```pascal
// TChilkatProgressInfoEvent = procedure(Sender: TChilkatBase; const Name, Value: string) of object;

property OnProgressInfo: TChilkatProgressInfoEvent;
```

This event callback provides `tag name`/value pairs that detail what occurs during a method call. To discover existing tag names, create code to handle the event, emit the pairs, and review them. Most tag names are self-explanatory.

Note: Some Chilkat methods don't fire any ProgressInfo events.

**Event callback implementation:**

```pascal
// A handler is a method of one of your own classes, e.g. a form:
procedure TMyObject.SshTunnelProgressInfo(Sender: TChilkatBase; const Name, Value: string);
begin
  WriteLn(Name, ': ', Value);
end;
```

**To add an event handler:**

```pascal
sshtunnel := TSshTunnel.Create;
sshtunnel.OnProgressInfo := MyObject.SshTunnelProgressInfo;
```

## Related classes

[`JsonObject`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/JsonObject.md), [`SecureString`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/SecureString.md), [`Ssh`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/Ssh.md), [`SshKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/SshKey.md)