---
product: Chilkat
product_version: 11.7.0
language: tcl
language_label: Tcl
class: SshTunnel
license: bundle
deprecated: false
reference_html: https://www.chilkatsoft.com/refdoc/tclSshTunnelRef.html
---
# Chilkat SshTunnel — Tcl — v11.7.0

> Chilkat 11.7.0 · language=tcl · class=SshTunnel
> Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0/<lang>/classes/SshTunnel.md`.
> Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/tcl/guide.md`.

## Purpose

**Create SSH tunnels for secure local, fixed-destination, dynamic, and multi-hop forwarding.**

`Chilkat.SshTunnel` creates SSH tunnels for forwarding local client connections through an SSH server to a destination service, such as a database server or other TCP service. It supports fixed destination forwarding, dynamic SOCKS-style port forwarding, password and public-key authentication, keyboard-interactive authentication, proxy connections to the SSH server, multi-hop SSH connections, background accept threads, tunnel/client logging, secure secret lookup, and connection diagnostics.

**Local port forwarding**

Listen on a local port and forward accepted client connections through an SSH server to a configured destination host and port.

**Dynamic forwarding**

Enable SOCKS-style dynamic port forwarding when each client connection should choose its own destination through the tunnel.

**SSH authentication**

Authenticate to the SSH server using passwords, public keys, password-plus-key, secure password lookup, or keyboard-interactive authentication.

**Proxy and multi-hop access**

Reach the SSH server through HTTP or SOCKS proxies, or build tunnels through an existing SSH connection for multi-hop scenarios.

**Accept and manage clients**

Start accepting client connections in the background, inspect current state, stop accepting new clients, and disconnect active tunnel clients.

**Logging and diagnostics**

Use accept logs, tunnel logs, current-state XML, and `LastErrorText` to troubleshoot SSH connection, forwarding, authentication, or client-connection problems.

**Common pattern:** Configure the SSH server, authentication method, local listen settings, and destination forwarding options, then call `BeginAccepting` to start the tunnel. Local client applications connect to the tunnel's listen port, and `SshTunnel` forwards the traffic through SSH. Use `Chilkat.SshTunnel` for port forwarding; use `Chilkat.Ssh` for direct SSH sessions, commands, channels, and shell access.

**Start with the SSH Tunneling Guide**

Learn how static forwarding, dynamic SOCKS forwarding, multi-hop tunneling, proxies, background threads, lifecycle management, and troubleshooting fit together.

[Open the SshTunnel Guide](https://www.chilkatsoft.com/sshtunnel_index.asp)

A shorter API-focused introduction is also available in the [SshTunnel Class Overview](https://www.chilkatsoft.com/sshtunnel_class_overview.asp).

## Object creation, unlocking and error handling

**Object Creation**

```tcl
# 'this' is not a keyword in Tcl. It can freely be used as a variable name.
set this [new CkSshTunnel]
```

Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Tcl.

How failure is reported depends on the method's return type and is stated in the note under each method below. In every case the diagnostic text is in the `LastErrorText` property of the object whose method was called.

## Members common to every Chilkat class

Documented once per language in `common-members.md`; listed here so this page is self-contained.

| Property | Signature | Access | Meaning |
|---|---|---|---|
| `DebugLogFilePath` | `string # ckStr is a CkString CkSshTunnel_get_DebugLogFilePath $this $ckStr set strVal [CkSshTunnel_get_debugLogFilePath $this] CkSshTunnel_put_DebugLogFilePath $this $strVal` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. |
| `LastErrorHtml` | `string # ckStr is a CkString CkSshTunnel_get_LastErrorHtml $this $ckStr set strVal [CkSshTunnel_get_lastErrorHtml $this]` | read-only | Provides HTML-formatted information about the last called method or property. |
| `LastErrorText` | `string # ckStr is a CkString CkSshTunnel_get_LastErrorText $this $ckStr set strVal [CkSshTunnel_get_lastErrorText $this]` | read-only | Provides plain text information about the last called method or property. |
| `LastErrorXml` | `string # ckStr is a CkString CkSshTunnel_get_LastErrorXml $this $ckStr set strVal [CkSshTunnel_get_lastErrorXml $this]` | read-only | Provides XML-formatted information about the last called method or property. |
| `LastMethodSuccess` | `boolean 1/0 set boolVal [CkSshTunnel_get_LastMethodSuccess $this] CkSshTunnel_put_LastMethodSuccess $this $boolVal` | read/write | Indicates the success or failure of the most recent method call: `1` means success, `0` means failure. |
| `Utf8` | `boolean 1/0 set boolVal [CkSshTunnel_get_Utf8 $this] CkSshTunnel_put_Utf8 $this $boolVal` | read/write | When set to `1`, all `string` arguments and return values are interpreted as UTF-8 strings. |
| `VerboseLogging` | `boolean 1/0 set boolVal [CkSshTunnel_get_VerboseLogging $this] CkSshTunnel_put_VerboseLogging $this $boolVal` | read/write | If set to `1`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. |
| `Version` | `string # ckStr is a CkString CkSshTunnel_get_Version $this $ckStr set strVal [CkSshTunnel_get_version $this]` | read-only | Version of the component/library, such as "10.1.0" |

## Member index

| Member | Kind | Signature |
|---|---|---|
| `AbortCurrent` | property, read/write | `boolean 1/0 set boolVal [CkSshTunnel_get_AbortCurrent $this] CkSshTunnel_put_AbortCurrent $this $boolVal` |
| `AcceptLog` | property, read/write | `string # ckStr is a CkString CkSshTunnel_get_AcceptLog $this $ckStr set strVal [CkSshTunnel_get_acceptLog $this] CkSshTunnel_put_AcceptLog $this $strVal` |
| `AcceptLogPath` | property, read/write | `string # ckStr is a CkString CkSshTunnel_get_AcceptLogPath $this $ckStr set strVal [CkSshTunnel_get_acceptLogPath $this] CkSshTunnel_put_AcceptLogPath $this $strVal` |
| `ClientIdentifier` | property, read/write | `string # ckStr is a CkString CkSshTunnel_get_ClientIdentifier $this $ckStr set strVal [CkSshTunnel_get_clientIdentifier $this] CkSshTunnel_put_ClientIdentifier $this $strVal` |
| `ClientLogDir` | property, read/write | `string # ckStr is a CkString CkSshTunnel_get_ClientLogDir $this $ckStr set strVal [CkSshTunnel_get_clientLogDir $this] CkSshTunnel_put_ClientLogDir $this $strVal` |
| `ConnectTimeoutMs` | property, read/write | `integer set intVal [CkSshTunnel_get_ConnectTimeoutMs $this] CkSshTunnel_put_ConnectTimeoutMs $this $intVal` |
| `DestHostname` | property, read/write | `string # ckStr is a CkString CkSshTunnel_get_DestHostname $this $ckStr set strVal [CkSshTunnel_get_destHostname $this] CkSshTunnel_put_DestHostname $this $strVal` |
| `DestPort` | property, read/write | `integer set intVal [CkSshTunnel_get_DestPort $this] CkSshTunnel_put_DestPort $this $intVal` |
| `DynamicPortForwarding` | property, read/write | `boolean 1/0 set boolVal [CkSshTunnel_get_DynamicPortForwarding $this] CkSshTunnel_put_DynamicPortForwarding $this $boolVal` |
| `EnableSecrets` | property, read/write | `boolean 1/0 set boolVal [CkSshTunnel_get_EnableSecrets $this] CkSshTunnel_put_EnableSecrets $this $boolVal` |
| `HostKeyFingerprint` | property, read-only | `string # ckStr is a CkString CkSshTunnel_get_HostKeyFingerprint $this $ckStr set strVal [CkSshTunnel_get_hostKeyFingerprint $this]` |
| `HttpProxyAuthMethod` | property, read/write | `string # ckStr is a CkString CkSshTunnel_get_HttpProxyAuthMethod $this $ckStr set strVal [CkSshTunnel_get_httpProxyAuthMethod $this] CkSshTunnel_put_HttpProxyAuthMethod $this $strVal` |
| `HttpProxyDomain` | property, read/write | `string # ckStr is a CkString CkSshTunnel_get_HttpProxyDomain $this $ckStr set strVal [CkSshTunnel_get_httpProxyDomain $this] CkSshTunnel_put_HttpProxyDomain $this $strVal` |
| `HttpProxyHostname` | property, read/write | `string # ckStr is a CkString CkSshTunnel_get_HttpProxyHostname $this $ckStr set strVal [CkSshTunnel_get_httpProxyHostname $this] CkSshTunnel_put_HttpProxyHostname $this $strVal` |
| `HttpProxyPassword` | property, read/write | `string # ckStr is a CkString CkSshTunnel_get_HttpProxyPassword $this $ckStr set strVal [CkSshTunnel_get_httpProxyPassword $this] CkSshTunnel_put_HttpProxyPassword $this $strVal` |
| `HttpProxyPort` | property, read/write | `integer set intVal [CkSshTunnel_get_HttpProxyPort $this] CkSshTunnel_put_HttpProxyPort $this $intVal` |
| `HttpProxyUsername` | property, read/write | `string # ckStr is a CkString CkSshTunnel_get_HttpProxyUsername $this $ckStr set strVal [CkSshTunnel_get_httpProxyUsername $this] CkSshTunnel_put_HttpProxyUsername $this $strVal` |
| `IdleTimeoutMs` | property, read/write | `integer set intVal [CkSshTunnel_get_IdleTimeoutMs $this] CkSshTunnel_put_IdleTimeoutMs $this $intVal` |
| `InboundSocksPassword` | property, read/write | `string # ckStr is a CkString CkSshTunnel_get_InboundSocksPassword $this $ckStr set strVal [CkSshTunnel_get_inboundSocksPassword $this] CkSshTunnel_put_InboundSocksPassword $this $strVal` |
| `InboundSocksUsername` | property, read/write | `string # ckStr is a CkString CkSshTunnel_get_InboundSocksUsername $this $ckStr set strVal [CkSshTunnel_get_inboundSocksUsername $this] CkSshTunnel_put_InboundSocksUsername $this $strVal` |
| `IsAccepting` | property, read-only | `boolean 1/0 set boolVal [CkSshTunnel_get_IsAccepting $this]` |
| `KeepAcceptLog` | property, read/write | `boolean 1/0 set boolVal [CkSshTunnel_get_KeepAcceptLog $this] CkSshTunnel_put_KeepAcceptLog $this $boolVal` |
| `KeepTunnelLog` | property, read/write | `boolean 1/0 set boolVal [CkSshTunnel_get_KeepTunnelLog $this] CkSshTunnel_put_KeepTunnelLog $this $boolVal` |
| `ListenBindIpAddress` | property, read/write | `string # ckStr is a CkString CkSshTunnel_get_ListenBindIpAddress $this $ckStr set strVal [CkSshTunnel_get_listenBindIpAddress $this] CkSshTunnel_put_ListenBindIpAddress $this $strVal` |
| `ListenPort` | property, read-only | `integer set intVal [CkSshTunnel_get_ListenPort $this]` |
| `OutboundBindIpAddress` | property, read/write | `string # ckStr is a CkString CkSshTunnel_get_OutboundBindIpAddress $this $ckStr set strVal [CkSshTunnel_get_outboundBindIpAddress $this] CkSshTunnel_put_OutboundBindIpAddress $this $strVal` |
| `OutboundBindPort` | property, read/write | `integer set intVal [CkSshTunnel_get_OutboundBindPort $this] CkSshTunnel_put_OutboundBindPort $this $intVal` |
| `PreferIpv6` | property, read/write | `boolean 1/0 set boolVal [CkSshTunnel_get_PreferIpv6 $this] CkSshTunnel_put_PreferIpv6 $this $boolVal` |
| `SocksHostname` | property, read/write | `string # ckStr is a CkString CkSshTunnel_get_SocksHostname $this $ckStr set strVal [CkSshTunnel_get_socksHostname $this] CkSshTunnel_put_SocksHostname $this $strVal` |
| `SocksPassword` | property, read/write | `string # ckStr is a CkString CkSshTunnel_get_SocksPassword $this $ckStr set strVal [CkSshTunnel_get_socksPassword $this] CkSshTunnel_put_SocksPassword $this $strVal` |
| `SocksPort` | property, read/write | `integer set intVal [CkSshTunnel_get_SocksPort $this] CkSshTunnel_put_SocksPort $this $intVal` |
| `SocksUsername` | property, read/write | `string # ckStr is a CkString CkSshTunnel_get_SocksUsername $this $ckStr set strVal [CkSshTunnel_get_socksUsername $this] CkSshTunnel_put_SocksUsername $this $strVal` |
| `SocksVersion` | property, read/write | `integer set intVal [CkSshTunnel_get_SocksVersion $this] CkSshTunnel_put_SocksVersion $this $intVal` |
| `SoRcvBuf` | property, read/write | `integer set intVal [CkSshTunnel_get_SoRcvBuf $this] CkSshTunnel_put_SoRcvBuf $this $intVal` |
| `SoSndBuf` | property, read/write | `integer set intVal [CkSshTunnel_get_SoSndBuf $this] CkSshTunnel_put_SoSndBuf $this $intVal` |
| `TcpNoDelay` | property, read/write | `boolean 1/0 set boolVal [CkSshTunnel_get_TcpNoDelay $this] CkSshTunnel_put_TcpNoDelay $this $boolVal` |
| `TunnelLog` | property, read/write | `string # ckStr is a CkString CkSshTunnel_get_TunnelLog $this $ckStr set strVal [CkSshTunnel_get_tunnelLog $this] CkSshTunnel_put_TunnelLog $this $strVal` |
| `TunnelLogPath` | property, read/write | `string # ckStr is a CkString CkSshTunnel_get_TunnelLogPath $this $ckStr set strVal [CkSshTunnel_get_tunnelLogPath $this] CkSshTunnel_put_TunnelLogPath $this $strVal` |
| `UncommonOptions` | property, read/write | `string # ckStr is a CkString CkSshTunnel_get_UncommonOptions $this $ckStr set strVal [CkSshTunnel_get_uncommonOptions $this] CkSshTunnel_put_UncommonOptions $this $strVal` |
| `AuthenticatePk` | method | `# username is a string # privateKey is a CkSshKey set status [CkSshTunnel_AuthenticatePk $this $username $privateKey]` |
| `AuthenticatePw` | method | `# login is a string # password is a string set status [CkSshTunnel_AuthenticatePw $this $login $password]` |
| `AuthenticatePwPk` | method | `# username is a string # password is a string # privateKey is a CkSshKey set status [CkSshTunnel_AuthenticatePwPk $this $username $password $privateKey]` |
| `AuthenticateSecPw` | method | `# login is a CkSecureString # password is a CkSecureString set status [CkSshTunnel_AuthenticateSecPw $this $login $password]` |
| `AuthenticateSecPwPk` | method | `# username is a CkSecureString # password is a CkSecureString # privateKey is a CkSshKey set status [CkSshTunnel_AuthenticateSecPwPk $this $username $password $privateKey]` |
| `BeginAccepting` | method | `# listenPort is an integer set status [CkSshTunnel_BeginAccepting $this $listenPort]` |
| `CloseTunnel` | method | `# waitForThreads is a boolean set status [CkSshTunnel_CloseTunnel $this $waitForThreads]` |
| `Connect` | method | `# hostname is a string # port is an integer set status [CkSshTunnel_Connect $this $hostname $port]` |
| `ConnectThroughSsh` | method | `# ssh is a CkSsh # hostname is a string # port is an integer set status [CkSshTunnel_ConnectThroughSsh $this $ssh $hostname $port]` |
| `ContinueKeyboardAuth` | method | `# response is a string # outStr is a CkString (output) set status [CkSshTunnel_ContinueKeyboardAuth $this $response $outStr] set retStr [CkSshTunnel_continueKeyboardAuth $this $response]` |
| `DisconnectAllClients` | method | `# waitForThreads is a boolean set status [CkSshTunnel_DisconnectAllClients $this $waitForThreads]` |
| `GetCurrentState` | method | `# outStr is a CkString (output) set status [CkSshTunnel_GetCurrentState $this $outStr] set retStr [CkSshTunnel_getCurrentState $this]` |
| `IsSshConnected` | method | `set retBool [CkSshTunnel_IsSshConnected $this]` |
| `LoadTaskCaller` | method | `# task is a CkTask set status [CkSshTunnel_LoadTaskCaller $this $task]` |
| `SetAllowedAlgorithms` | method | `# json is a CkJsonObject set status [CkSshTunnel_SetAllowedAlgorithms $this $json]` |
| `StartKeyboardAuth` | method | `# login is a string # outStr is a CkString (output) set status [CkSshTunnel_StartKeyboardAuth $this $login $outStr] set retStr [CkSshTunnel_startKeyboardAuth $this $login]` |
| `StopAccepting` | method | `# waitForThread is a boolean set status [CkSshTunnel_StopAccepting $this $waitForThread]` |

## Properties

### SshTunnel.AbortCurrent

`Chilkat 11.7.0 · tcl · SshTunnel · AbortCurrent · property · read/write · since 9.5.0.58`

```tcl
boolean 1/0
set boolVal [CkSshTunnel_get_AbortCurrent $this]

CkSshTunnel_put_AbortCurrent $this $boolVal
```

Set this property to `1` from another thread to request that the currently running foreground operation be aborted. For example, it can interrupt a synchronous `Connect` that is waiting for an SSH server response.

This property does not stop the background listener or terminate established background tunnel clients.

Do not assume the property is automatically reset after an operation is aborted. It may remain `1`; set it back to `0` before starting another operation.

### SshTunnel.AcceptLog

`Chilkat 11.7.0 · tcl · SshTunnel · AcceptLog · property · read/write`

```tcl
string
# ckStr is a CkString

CkSshTunnel_get_AcceptLog $this $ckStr

set strVal [CkSshTunnel_get_acceptLog $this]

CkSshTunnel_put_AcceptLog $this $strVal
```

Contains the in-memory activity log for the background listener thread started by `BeginAccepting`.

The log is populated only when `KeepAcceptLog` is `1`.

### SshTunnel.AcceptLogPath

`Chilkat 11.7.0 · tcl · SshTunnel · AcceptLogPath · property · read/write · since 9.5.0.50`

```tcl
string
# ckStr is a CkString

CkSshTunnel_get_AcceptLogPath $this $ckStr

set strVal [CkSshTunnel_get_acceptLogPath $this]

CkSshTunnel_put_AcceptLogPath $this $strVal
```

Specifies the local file path where activity from the background listener thread is written.

This file-based log is separate from the in-memory `AcceptLog`.

### SshTunnel.ClientIdentifier

`Chilkat 11.7.0 · tcl · SshTunnel · ClientIdentifier · property · read/write · since 9.5.0.95`

```tcl
string
# ckStr is a CkString

CkSshTunnel_get_ClientIdentifier $this $ckStr

set strVal [CkSshTunnel_get_clientIdentifier $this]

CkSshTunnel_put_ClientIdentifier $this $strVal
```

Specifies the SSH client-identification string sent when connecting to the SSH server.

Starting in Chilkat v9.5.0.99, the default is `SSH-2.0-Chilkat_` followed by the Chilkat version number, such as `SSH-2.0-Chilkat_9.5.0.99`.

The identifier should begin with `SSH-2.0-`. Some SSH servers disconnect clients that send an invalid identification string.

### SshTunnel.ClientLogDir

`Chilkat 11.7.0 · tcl · SshTunnel · ClientLogDir · property · read/write · since 11.1.0`

```tcl
string
# ckStr is a CkString

CkSshTunnel_get_ClientLogDir $this $ckStr

set strVal [CkSshTunnel_get_clientLogDir $this]

CkSshTunnel_put_ClientLogDir $this $strVal
```

Specifies the local directory where a separate log file is created for each tunnel client.

When this property is not empty, files are named using the pattern `tunnel_client_log_{random_id}.txt`.

### SshTunnel.ConnectTimeoutMs

`Chilkat 11.7.0 · tcl · SshTunnel · ConnectTimeoutMs · property · read/write`

```tcl
integer
set intVal [CkSshTunnel_get_ConnectTimeoutMs $this]

CkSshTunnel_put_ConnectTimeoutMs $this $intVal
```

Specifies the maximum number of milliseconds allowed for establishing the SSH connection.

- The default value is `30000` milliseconds (30 seconds).
- A value of `0` disables the connection timeout and allows an unlimited wait.

The timeout applies to more than the initial TCP connection. It also covers connection setup performed through an HTTP or SOCKS proxy and waiting for the SSH server identification string after the TCP connection has been established.

### SshTunnel.DestHostname

`Chilkat 11.7.0 · tcl · SshTunnel · DestHostname · property · read/write`

```tcl
string
# ckStr is a CkString

CkSshTunnel_get_DestHostname $this $ckStr

set strVal [CkSshTunnel_get_destHostname $this]

CkSshTunnel_put_DestHostname $this $strVal
```

Specifies the destination hostname or IP address for fixed-destination port forwarding. This is typically the host running the database server or other TCP service that local clients need to reach.

The destination is interpreted from the SSH server's network environment. For example, `localhost` and `127.0.0.1` refer to the SSH server itself, not the computer running the application. Hostname resolution is therefore performed as part of the forwarding request on the SSH-server side.

Traffic accepted by the local listener is carried through SSH, forwarded by the SSH server to this destination, and returned through the same tunnel.

This property is ignored when `DynamicPortForwarding` is `1`. Changing the destination while the listener is running affects new clients only; existing clients remain connected to the destination selected when they were accepted.

### SshTunnel.DestPort

`Chilkat 11.7.0 · tcl · SshTunnel · DestPort · property · read/write`

```tcl
integer
set intVal [CkSshTunnel_get_DestPort $this]

CkSshTunnel_put_DestPort $this $intVal
```

Specifies the TCP port of the destination service used for fixed-destination forwarding, such as the port of a database server.

It is used together with `DestHostname` and is ignored when `DynamicPortForwarding` is `1`.

### SshTunnel.DynamicPortForwarding

`Chilkat 11.7.0 · tcl · SshTunnel · DynamicPortForwarding · property · read/write · since 9.5.0.50`

```tcl
boolean 1/0
set boolVal [CkSshTunnel_get_DynamicPortForwarding $this]

CkSshTunnel_put_DynamicPortForwarding $this $boolVal
```

Controls whether the listener performs fixed-destination or dynamic port forwarding.

- When `0` (the default), every accepted connection is forwarded to `DestHostname` and `DestPort`.
- When `1`, the listener acts as a SOCKS proxy and each inbound client supplies its own destination.

The SOCKS version is detected independently from each inbound client handshake; there is no separate inbound SOCKS-version property. SOCKS4 and SOCKS5 `CONNECT` requests are supported. SOCKS5 `BIND` and UDP association are not supported.

Leave `InboundSocksUsername` empty to allow SOCKS5 clients to use the no-authentication method. Set the inbound username and password to require SOCKS5 username/password authentication. For SOCKS4, only the user ID can be checked because SOCKS4 has no password field.

SOCKS4a hostname-form requests are not supported. Use a numeric IPv4 address with SOCKS4, or use SOCKS5 when the client needs to supply a domain name.

### SshTunnel.EnableSecrets

`Chilkat 11.7.0 · tcl · SshTunnel · EnableSecrets · property · read/write · since 11.5.0`

```tcl
boolean 1/0
set boolVal [CkSshTunnel_get_EnableSecrets $this]

CkSshTunnel_put_EnableSecrets $this $boolVal
```

**Full documentation for this property (same in every language):** [More Detailed Information About EnableSecrets](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/secret_specification_strings.md)

Enables automatic resolution of credentials from secure storage provided by the operating system.

When set to `1`, supported password properties and methods may receive a **secret specification string** beginning with `!!` instead of a literal password. Chilkat resolves the secret from:

- Windows Credential Manager on Windows.
- Apple Keychain on macOS.

The specification format is: `!![appName|]service[|domain]|username`

This applies to `HttpProxyPassword`, `SocksPassword`, `AuthenticatePw`, and `AuthenticatePwPk`.

The default value is `0`.

### SshTunnel.HostKeyFingerprint

`Chilkat 11.7.0 · tcl · SshTunnel · HostKeyFingerprint · property · read-only · since 9.5.0.56`

```tcl
string
# ckStr is a CkString

CkSshTunnel_get_HostKeyFingerprint $this $ckStr

set strVal [CkSshTunnel_get_hostKeyFingerprint $this]
```

Contains the SSH server host-key fingerprint after `Connect` or `ConnectThroughSsh` establishes the SSH connection. The value is available before user authentication.

Example: `ssh-ed25519 256 e0:33:b1:81:a5:c6:9a:d2:2e:c9:d3:15:60:ea:cf:4c`

Compare this value with a trusted expected fingerprint to verify the identity of the SSH server. For `ConnectThroughSsh`, the fingerprint is for the final SSH server, not the first-hop server.

The value may remain populated after `CloseTunnel` or after the connection is lost. Use `IsSshConnected` to determine current connection state.

### SshTunnel.HttpProxyAuthMethod

`Chilkat 11.7.0 · tcl · SshTunnel · HttpProxyAuthMethod · property · read/write`

```tcl
string
# ckStr is a CkString

CkSshTunnel_get_HttpProxyAuthMethod $this $ckStr

set strVal [CkSshTunnel_get_httpProxyAuthMethod $this]

CkSshTunnel_put_HttpProxyAuthMethod $this $strVal
```

Specifies the authentication method to use when the outbound connection to the SSH server passes through an HTTP proxy that requires authentication.

Valid values are `Basic` and `NTLM`.

If `SocksVersion` is set to `4` or `5`, the SOCKS proxy takes precedence and these HTTP proxy settings are ignored. The proxies are not chained.

### SshTunnel.HttpProxyDomain

`Chilkat 11.7.0 · tcl · SshTunnel · HttpProxyDomain · property · read/write`

```tcl
string
# ckStr is a CkString

CkSshTunnel_get_HttpProxyDomain $this $ckStr

set strVal [CkSshTunnel_get_httpProxyDomain $this]

CkSshTunnel_put_HttpProxyDomain $this $strVal
```

Specifies the optional Windows domain used for NTLM authentication with the HTTP proxy.

This applies only to the outbound proxy connection used to reach the SSH server, and only when `HttpProxyAuthMethod` is `NTLM`.

If `SocksVersion` is set to `4` or `5`, the SOCKS proxy takes precedence and these HTTP proxy settings are ignored. The proxies are not chained.

### SshTunnel.HttpProxyHostname

`Chilkat 11.7.0 · tcl · SshTunnel · HttpProxyHostname · property · read/write`

```tcl
string
# ckStr is a CkString

CkSshTunnel_get_HttpProxyHostname $this $ckStr

set strVal [CkSshTunnel_get_httpProxyHostname $this]

CkSshTunnel_put_HttpProxyHostname $this $strVal
```

Specifies the hostname or IPv4 address of the HTTP proxy through which the outbound connection to the SSH server is made.

Leave this property empty when no HTTP proxy is required.

If `SocksVersion` is set to `4` or `5`, the SOCKS proxy takes precedence and these HTTP proxy settings are ignored. The proxies are not chained.

### SshTunnel.HttpProxyPassword

`Chilkat 11.7.0 · tcl · SshTunnel · HttpProxyPassword · property · read/write`

```tcl
string
# ckStr is a CkString

CkSshTunnel_get_HttpProxyPassword $this $ckStr

set strVal [CkSshTunnel_get_httpProxyPassword $this]

CkSshTunnel_put_HttpProxyPassword $this $strVal
```

Specifies the password used to authenticate with the HTTP proxy for the outbound connection to the SSH server.

If `SocksVersion` is set to `4` or `5`, the SOCKS proxy takes precedence and these HTTP proxy settings are ignored. The proxies are not chained.

### SshTunnel.HttpProxyPort

`Chilkat 11.7.0 · tcl · SshTunnel · HttpProxyPort · property · read/write`

```tcl
integer
set intVal [CkSshTunnel_get_HttpProxyPort $this]

CkSshTunnel_put_HttpProxyPort $this $intVal
```

Specifies the TCP port of the HTTP proxy used for the outbound connection to the SSH server.

Common HTTP proxy ports include `8080` and `3128`.

If `SocksVersion` is set to `4` or `5`, the SOCKS proxy takes precedence and these HTTP proxy settings are ignored. The proxies are not chained.

### SshTunnel.HttpProxyUsername

`Chilkat 11.7.0 · tcl · SshTunnel · HttpProxyUsername · property · read/write`

```tcl
string
# ckStr is a CkString

CkSshTunnel_get_HttpProxyUsername $this $ckStr

set strVal [CkSshTunnel_get_httpProxyUsername $this]

CkSshTunnel_put_HttpProxyUsername $this $strVal
```

Specifies the username used to authenticate with the HTTP proxy for the outbound connection to the SSH server.

If `SocksVersion` is set to `4` or `5`, the SOCKS proxy takes precedence and these HTTP proxy settings are ignored. The proxies are not chained.

### SshTunnel.IdleTimeoutMs

`Chilkat 11.7.0 · tcl · SshTunnel · IdleTimeoutMs · property · read/write`

```tcl
integer
set intVal [CkSshTunnel_get_IdleTimeoutMs $this]

CkSshTunnel_put_IdleTimeoutMs $this $intVal
```

Specifies a stall timeout, in milliseconds, for tunnel data-transfer operations. The default value is `30000` milliseconds (30 seconds). A value of `0` disables the timeout.

This property is not a general inactivity timer for established background tunnel clients. An otherwise idle client, or a client with data queued while an SSH channel is flow-controlled, may remain connected beyond this interval. Applications should not rely on this property to disconnect clients merely because no application data is flowing.

### SshTunnel.InboundSocksPassword

`Chilkat 11.7.0 · tcl · SshTunnel · InboundSocksPassword · property · read/write · since 9.5.0.50`

```tcl
string
# ckStr is a CkString

CkSshTunnel_get_InboundSocksPassword $this $ckStr

set strVal [CkSshTunnel_get_inboundSocksPassword $this]

CkSshTunnel_put_InboundSocksPassword $this $strVal
```

Specifies the password required from inbound SOCKS5 clients when `DynamicPortForwarding` is `1`.

This property is used together with `InboundSocksUsername`. It does not apply to SOCKS4 because the SOCKS4 protocol has no password field.

### SshTunnel.InboundSocksUsername

`Chilkat 11.7.0 · tcl · SshTunnel · InboundSocksUsername · property · read/write · since 9.5.0.50`

```tcl
string
# ckStr is a CkString

CkSshTunnel_get_InboundSocksUsername $this $ckStr

set strVal [CkSshTunnel_get_inboundSocksUsername $this]

CkSshTunnel_put_InboundSocksUsername $this $strVal
```

Specifies the username required from inbound SOCKS clients when `DynamicPortForwarding` is `1`.

- For SOCKS5, setting this property enables username/password authentication.
- For SOCKS4, the value is compared with the client-supplied user ID.
- Leave it empty to require no inbound SOCKS username.

### SshTunnel.IsAccepting

`Chilkat 11.7.0 · tcl · SshTunnel · IsAccepting · property · read-only`

```tcl
boolean 1/0
set boolVal [CkSshTunnel_get_IsAccepting $this]
```

`1` when the local listener thread is running and accepting inbound TCP connections; otherwise `0`.

This property describes only the local listener. It can remain `1` after the SSH connection is lost or after `CloseTunnel` is called. In those states a client may connect to the local port even though its traffic cannot be forwarded.

Use `IsSshConnected` separately when the application also needs to know whether the SSH transport is available.

### SshTunnel.KeepAcceptLog

`Chilkat 11.7.0 · tcl · SshTunnel · KeepAcceptLog · property · read/write`

```tcl
boolean 1/0
set boolVal [CkSshTunnel_get_KeepAcceptLog $this]

CkSshTunnel_put_KeepAcceptLog $this $boolVal
```

Controls whether activity from the background listener thread is retained in memory.

The default value is `0`. When enabled, retrieve the log from `AcceptLog`.

### SshTunnel.KeepTunnelLog

`Chilkat 11.7.0 · tcl · SshTunnel · KeepTunnelLog · property · read/write · since 9.5.0.50`

```tcl
boolean 1/0
set boolVal [CkSshTunnel_get_KeepTunnelLog $this]

CkSshTunnel_put_KeepTunnelLog $this $boolVal
```

Controls whether SSH tunnel-thread activity is retained in memory.

The default value is `0`. When enabled, retrieve the log from `TunnelLog`.

### SshTunnel.ListenBindIpAddress

`Chilkat 11.7.0 · tcl · SshTunnel · ListenBindIpAddress · property · read/write`

```tcl
string
# ckStr is a CkString

CkSshTunnel_get_ListenBindIpAddress $this $ckStr

set strVal [CkSshTunnel_get_listenBindIpAddress $this]

CkSshTunnel_put_ListenBindIpAddress $this $strVal
```

Specifies the local IPv4 address to which the tunnel's listening socket is bound.

| Value | Listener exposure |
| :--- | :--- |
| Empty string | Binds to `0.0.0.0` and accepts connections on all local IPv4 interfaces, subject to firewall rules. |
| `127.0.0.1` | Accepts connections only from the local computer through loopback. |
| A specific local LAN address | Accepts connections through that interface only; loopback is not included automatically. |

For a tunnel intended only for local applications, explicitly set this property to `127.0.0.1`. Leaving it empty may expose the listening port to other computers on the network.

If the value is malformed or is not assigned to a local interface, `BeginAccepting` returns `0` and the bind failure is available in `LastErrorText` and the accept log.

### SshTunnel.ListenPort

`Chilkat 11.7.0 · tcl · SshTunnel · ListenPort · property · read-only`

```tcl
integer
set intVal [CkSshTunnel_get_ListenPort $this]
```

Contains the local TCP port used by the listener started by `BeginAccepting`.

- If `BeginAccepting` succeeds with a nonzero requested port, this property contains that port.
- If `BeginAccepting` succeeds with `0`, the operating system chooses an available port and this property contains the allocated port when the method returns.
- After a bind failure for an explicitly requested port, this property may still contain the requested port even though `IsAccepting` is `0`.
- The value is initially `0`.

### SshTunnel.OutboundBindIpAddress

`Chilkat 11.7.0 · tcl · SshTunnel · OutboundBindIpAddress · property · read/write`

```tcl
string
# ckStr is a CkString

CkSshTunnel_get_OutboundBindIpAddress $this $ckStr

set strVal [CkSshTunnel_get_outboundBindIpAddress $this]

CkSshTunnel_put_OutboundBindIpAddress $this $strVal
```

Specifies the local IP address to which the outbound socket is bound before connecting to the SSH server.

Most applications should leave this property empty. Set it only on a multihomed computer when the SSH connection must originate from a specific local network interface or IP address.

### SshTunnel.OutboundBindPort

`Chilkat 11.7.0 · tcl · SshTunnel · OutboundBindPort · property · read/write`

```tcl
integer
set intVal [CkSshTunnel_get_OutboundBindPort $this]

CkSshTunnel_put_OutboundBindPort $this $intVal
```

Specifies the local TCP port to bind before making the outbound connection to the SSH server.

The default value is `0`, which allows the operating system to choose an available ephemeral port. Nearly all applications should leave this property unchanged.

### SshTunnel.PreferIpv6

`Chilkat 11.7.0 · tcl · SshTunnel · PreferIpv6 · property · read/write · since 9.5.0.70`

```tcl
boolean 1/0
set boolVal [CkSshTunnel_get_PreferIpv6 $this]

CkSshTunnel_put_PreferIpv6 $this $boolVal
```

Controls which IP version is preferred when a hostname resolves to both IPv4 and IPv6 addresses.

- `0` (the default) prefers IPv4.
- `1` prefers IPv6.

### SshTunnel.SocksHostname

`Chilkat 11.7.0 · tcl · SshTunnel · SocksHostname · property · read/write`

```tcl
string
# ckStr is a CkString

CkSshTunnel_get_SocksHostname $this $ckStr

set strVal [CkSshTunnel_get_socksHostname $this]

CkSshTunnel_put_SocksHostname $this $strVal
```

Specifies the hostname or IPv4 address of the outbound SOCKS4 or SOCKS5 proxy used to reach the SSH server.

This property is used only when `SocksVersion` is `4` or `5`.

### SshTunnel.SocksPassword

`Chilkat 11.7.0 · tcl · SshTunnel · SocksPassword · property · read/write`

```tcl
string
# ckStr is a CkString

CkSshTunnel_get_SocksPassword $this $ckStr

set strVal [CkSshTunnel_get_socksPassword $this]

CkSshTunnel_put_SocksPassword $this $strVal
```

Specifies the password for authenticating with an outbound SOCKS5 proxy used to reach the SSH server.

SOCKS4 does not support password authentication, so this property does not apply when `SocksVersion` is `4`.

### SshTunnel.SocksPort

`Chilkat 11.7.0 · tcl · SshTunnel · SocksPort · property · read/write`

```tcl
integer
set intVal [CkSshTunnel_get_SocksPort $this]

CkSshTunnel_put_SocksPort $this $intVal
```

Specifies the TCP port of the outbound SOCKS4 or SOCKS5 proxy used to reach the SSH server.

The default value is `1080`. This property is used only when `SocksVersion` is `4` or `5`.

### SshTunnel.SocksUsername

`Chilkat 11.7.0 · tcl · SshTunnel · SocksUsername · property · read/write`

```tcl
string
# ckStr is a CkString

CkSshTunnel_get_SocksUsername $this $ckStr

set strVal [CkSshTunnel_get_socksUsername $this]

CkSshTunnel_put_SocksUsername $this $strVal
```

Specifies the username for the outbound SOCKS4 or SOCKS5 proxy used to reach the SSH server.

This property is used only when `SocksVersion` is `4` or `5`.

### SshTunnel.SocksVersion

`Chilkat 11.7.0 · tcl · SshTunnel · SocksVersion · property · read/write`

```tcl
integer
set intVal [CkSshTunnel_get_SocksVersion $this]

CkSshTunnel_put_SocksVersion $this $intVal
```

Selects whether the outbound connection to the SSH server is made through a SOCKS proxy.

| Value | Behavior |
| :--- | :--- |
| `0` | Do not use a SOCKS proxy. This is the default. |
| `4` | Connect through a SOCKS4 proxy. |
| `5` | Connect through a SOCKS5 proxy. |

When this property is `4` or `5`, the SOCKS proxy settings take precedence over the HTTP proxy settings. The SOCKS and HTTP proxies are not chained.

### SshTunnel.SoRcvBuf

`Chilkat 11.7.0 · tcl · SshTunnel · SoRcvBuf · property · read/write`

```tcl
integer
set intVal [CkSshTunnel_get_SoRcvBuf $this]

CkSshTunnel_put_SoRcvBuf $this $intVal
```

Sets the receive-buffer size for the underlying TCP socket.

The default value is `4194304` bytes. Normally this property should remain unchanged. If receive performance is unusually slow, testing a larger value that is a multiple of `4096` may help.

See also:

- [More Information about TCP performance and Buffer Sizes](http://www.cknotes.com/?p=446)

### SshTunnel.SoSndBuf

`Chilkat 11.7.0 · tcl · SshTunnel · SoSndBuf · property · read/write`

```tcl
integer
set intVal [CkSshTunnel_get_SoSndBuf $this]

CkSshTunnel_put_SoSndBuf $this $intVal
```

Sets the send-buffer size for the underlying TCP socket.

The default value is `262144` bytes. Normally this property should remain unchanged. If send performance is unusually slow, testing values such as `524288` or `1048576` may help. A multiple of `4096` is recommended.

See also:

- [More Information about TCP performance and Buffer Sizes](http://www.cknotes.com/?p=446)

### SshTunnel.TcpNoDelay

`Chilkat 11.7.0 · tcl · SshTunnel · TcpNoDelay · property · read/write`

```tcl
boolean 1/0
set boolVal [CkSshTunnel_get_TcpNoDelay $this]

CkSshTunnel_put_TcpNoDelay $this $boolVal
```

Controls the `TCP_NODELAY` socket option for the underlying TCP connection.

The default value is `0`. Setting it to `1` disables the Nagle algorithm, which can reduce latency when many small amounts of data are sent.

### SshTunnel.TunnelLog

`Chilkat 11.7.0 · tcl · SshTunnel · TunnelLog · property · read/write · since 9.5.0.50`

```tcl
string
# ckStr is a CkString

CkSshTunnel_get_TunnelLog $this $ckStr

set strVal [CkSshTunnel_get_tunnelLog $this]

CkSshTunnel_put_TunnelLog $this $strVal
```

Contains the in-memory activity log for the SSH tunnel and client-manager threads. The log is populated only when `KeepTunnelLog` is `1`.

Treat this log as sensitive diagnostic data. It can contain hostnames, ports, usernames, proxy details, SOCKS handshake information, and authentication failure values. Do not publish or persist it without reviewing and protecting its contents.

### SshTunnel.TunnelLogPath

`Chilkat 11.7.0 · tcl · SshTunnel · TunnelLogPath · property · read/write · since 9.5.0.50`

```tcl
string
# ckStr is a CkString

CkSshTunnel_get_TunnelLogPath $this $ckStr

set strVal [CkSshTunnel_get_tunnelLogPath $this]

CkSshTunnel_put_TunnelLogPath $this $strVal
```

Specifies the local file path where SSH tunnel-thread activity is written.

This file-based log is separate from the in-memory `TunnelLog`.

### SshTunnel.UncommonOptions

`Chilkat 11.7.0 · tcl · SshTunnel · UncommonOptions · property · read/write · since 9.5.0.73`

```tcl
string
# ckStr is a CkString

CkSshTunnel_get_UncommonOptions $this $ckStr

set strVal [CkSshTunnel_get_uncommonOptions $this]

CkSshTunnel_put_UncommonOptions $this $strVal
```

Provides optional behavior for uncommon requirements. The default value is an empty string, which is appropriate for most applications.

To enable more than one option, provide a comma-separated list of keywords.

| Keyword | Effect |
| :--- | :--- |
| `ForceUserAuthRsaSha1` | Forces `rsa-sha1` for public-key user authentication. Set this before connecting. Added in v9.5.0.98. |
| `NoKeepAliveIgnoreMsg` | Disables the default SSH `ignore` message sent every 20 seconds to keep an idle connection alive. Added in v9.5.0.76. |
| `no-weak-mac-algs` | Removes `hmac-sha1-96`, `hmac-sha1`, `hmac-md5`, and `hmac-ripemd160` from the offered MAC algorithms. Added in v9.5.0.98. |
| `ProtectFromVpn` | On Android, bypasses an installed or active VPN. Added in v9.5.0.80. |
| `+ssh-hmac-etm` | Re-enables SSH encrypt-then-MAC algorithms that were disabled by default in v9.5.0.97 as part of the Terrapin mitigation. |
| `+chacha20-poly1305@openssh.com` | Re-enables `chacha20-poly1305@openssh.com`, which was removed from the default offer in v9.5.0.97 as part of the Terrapin mitigation. |

## Methods

### SshTunnel.AuthenticatePk

`Chilkat 11.7.0 · tcl · SshTunnel · AuthenticatePk · method · since 9.5.0.50`

```tcl
# username is a string

# privateKey is a CkSshKey

set status [CkSshTunnel_AuthenticatePk $this $username  $privateKey]
```

Authenticates with the SSH server using public-key authentication.

The public key corresponding to `privateKey` must already be installed for `username` on the SSH server.

Call `Connect` or `ConnectThroughSsh` before calling this method.

When requesting support for an authentication failure, include the complete `LastErrorText`.

Returns 1 for success, 0 for failure.

Async variant: `AuthenticatePkAsync` — same arguments, returns a `Task` (see Async variants below).

See also:

- [Beware of too much time between connect and authentication.](http://www.cknotes.com/?p=278)

### SshTunnel.AuthenticatePw

`Chilkat 11.7.0 · tcl · SshTunnel · AuthenticatePw · method · since 9.5.0.50`

```tcl
# login is a string

# password is a string

set status [CkSshTunnel_AuthenticatePw $this $login  $password]
```

Authenticates with the SSH server using `login` and `password`.

Establish the SSH connection first by calling `Connect` or `ConnectThroughSsh`. After authentication succeeds, call `BeginAccepting` to begin accepting tunnel clients.

- A rejected username or password does not close the SSH connection; the application may correct the credentials and call this method again.
- Calling this method again after authentication has already succeeded returns `0` with an “Already authenticated” error.

When requesting support for an authentication failure, include the complete `LastErrorText` captured immediately after the failed call.

Returns 1 for success, 0 for failure.

Async variant: `AuthenticatePwAsync` — same arguments, returns a `Task` (see Async variants below).

See also:

- [Beware of too much time between connect and authentication.](http://www.cknotes.com/?p=278)

### SshTunnel.AuthenticatePwPk

`Chilkat 11.7.0 · tcl · SshTunnel · AuthenticatePwPk · method · since 9.5.0.50`

```tcl
# username is a string

# password is a string

# privateKey is a CkSshKey

set status [CkSshTunnel_AuthenticatePwPk $this $username  $password  $privateKey]
```

Authenticates with an SSH server that requires both a password and a private key.

The public key corresponding to `privateKey` must already be installed for `username` on the SSH server. Most SSH servers require either password authentication or public-key authentication rather than both.

When requesting support for an authentication failure, include the complete `LastErrorText`.

Returns 1 for success, 0 for failure.

Async variant: `AuthenticatePwPkAsync` — same arguments, returns a `Task` (see Async variants below).

### SshTunnel.AuthenticateSecPw

`Chilkat 11.7.0 · tcl · SshTunnel · AuthenticateSecPw · method · since 9.5.0.71`

```tcl
# login is a CkSecureString

# password is a CkSecureString

set status [CkSshTunnel_AuthenticateSecPw $this $login  $password]
```

Performs the same password authentication as `AuthenticatePw`, but receives the login and password in `SecureString` objects.

Returns 1 for success, 0 for failure.

Async variant: `AuthenticateSecPwAsync` — same arguments, returns a `Task` (see Async variants below).

### SshTunnel.AuthenticateSecPwPk

`Chilkat 11.7.0 · tcl · SshTunnel · AuthenticateSecPwPk · method · since 9.5.0.71`

```tcl
# username is a CkSecureString

# password is a CkSecureString

# privateKey is a CkSshKey

set status [CkSshTunnel_AuthenticateSecPwPk $this $username  $password  $privateKey]
```

Performs the same combined password-and-private-key authentication as `AuthenticatePwPk`, but receives the username and password in `SecureString` objects.

Returns 1 for success, 0 for failure.

Async variant: `AuthenticateSecPwPkAsync` — same arguments, returns a `Task` (see Async variants below).

### SshTunnel.BeginAccepting

`Chilkat 11.7.0 · tcl · SshTunnel · BeginAccepting · method`

```tcl
# listenPort is an integer

set status [CkSshTunnel_BeginAccepting $this $listenPort]
```

Creates and starts the local listener on `listenPort`.

The SSH connection must already have been established. Although the listener can be started before user authentication, clients accepted in that state cannot be forwarded. The recommended sequence is to connect, authenticate, and then call this method.

- The requested port must not already be in use on the selected local interface.
- Pass `0` to let the operating system choose an available port, then read `ListenPort`.
- Calling this method while the listener is already running returns `0`.

The method waits for the initial bind-and-listen result. It returns `0` for errors such as an occupied port, a malformed bind address, or an address that is not assigned to the local computer. Details are available immediately in `LastErrorText` and, when enabled, the accept log.

A successful return means the listener was bound and started. No additional fixed delay is required merely to discover an initial bind failure.

Returns 1 for success, 0 for failure.

Async variant: `BeginAcceptingAsync` — same arguments, returns a `Task` (see Async variants below).

### SshTunnel.CloseTunnel

`Chilkat 11.7.0 · tcl · SshTunnel · CloseTunnel · method · since 9.5.0.50`

```tcl
# waitForThreads is a boolean

set status [CkSshTunnel_CloseTunnel $this $waitForThreads]
```

Disconnects active tunnel clients and stops the tunnel-manager thread.

When `waitForThreads` is `1`, the method waits for the client and tunnel-manager threads to exit. It returns `0` if a worker thread does not stop; capture `LastErrorText` immediately for details.

This method does not stop the local listener and does not disconnect or reset the underlying SSH transport. Call `StopAccepting` separately to stop accepting local TCP connections. After this method returns, the listener may still accept a local connection even though the connection cannot be forwarded.

Calling this method more than once is allowed. However, it does not reset the object for a new call to `Connect`. Use a new `SshTunnel` object when connecting to a different SSH server.

Returns 1 for success, 0 for failure.

### SshTunnel.Connect

`Chilkat 11.7.0 · tcl · SshTunnel · Connect · method · since 9.5.0.50`

```tcl
# hostname is a string

# port is an integer

set status [CkSshTunnel_Connect $this $hostname  $port]
```

Establishes the SSH connection that will carry tunneled traffic. This method performs the TCP or proxy connection, the SSH protocol handshake, and host-key negotiation, but it does not authenticate the SSH user.

After connecting, verify `HostKeyFingerprint`, then authenticate by calling one of the `Authenticate*` methods. Finally, call `BeginAccepting` to start the local listener.

The host-key fingerprint is available immediately after this method succeeds, before user authentication. Calling `Connect` again while an SSH tunnel already exists returns `0`.

Chilkat sends an SSH `ignore` message every 20 seconds to help keep an unused SSH connection alive. To disable this behavior, add `NoKeepAliveIgnoreMsg` to `UncommonOptions` before connecting.

Returns 1 for success, 0 for failure.

Async variant: `ConnectAsync` — same arguments, returns a `Task` (see Async variants below).

### SshTunnel.ConnectThroughSsh

`Chilkat 11.7.0 · tcl · SshTunnel · ConnectThroughSsh · method · since 9.5.0.55`

```tcl
# ssh is a CkSsh

# hostname is a string

# port is an integer

set status [CkSshTunnel_ConnectThroughSsh $this $ssh  $hostname  $port]
```

Connects to a second SSH server through the existing connected and authenticated `Ssh` object supplied in `ssh`.

```
application -> first SSH server -> second SSH server
```

`hostname` and `port` identify the second SSH server. After this method succeeds, call an authentication method on this `SshTunnel` object to authenticate with the second server.

The supplied `Ssh` object is borrowed, not copied. It must remain alive, connected, and authenticated for as long as this tunnel is used. If the first-hop object is disconnected, existing forwarded clients stop working and new local connections cannot be forwarded. The local listener may nevertheless remain active until explicitly stopped.

`HostKeyFingerprint` reports the fingerprint of the second SSH server. After the connection is established, fixed forwarding destinations such as `127.0.0.1` are interpreted from the second server's network environment.

Returns 1 for success, 0 for failure.

Async variant: `ConnectThroughSshAsync` — same arguments, returns a `Task` (see Async variants below).

### SshTunnel.ContinueKeyboardAuth

`Chilkat 11.7.0 · tcl · SshTunnel · ContinueKeyboardAuth · method · since 9.5.0.78`

```tcl
# response is a string

# outStr is a CkString (output)

set status [CkSshTunnel_ContinueKeyboardAuth $this $response $outStr]

set retStr [CkSshTunnel_continueKeyboardAuth $this $response]
```

Continues a keyboard-interactive authentication exchange started by `StartKeyboardAuth`.

If the server requested one response, pass that value directly in `response`. If it requested multiple responses, pass XML in the following form:

```
<response>
  <response1>response to first prompt</response1>
  <response2>response to second prompt</response2>
  ...
  <responseN>response to Nth prompt</responseN>
</response>
```

When authentication completes, the returned XML indicates success or failure:

```
<success>success message</success>

<error>error message</error>
```

If another challenge is required, the method returns another `infoRequest` XML document containing the next set of prompts.

Returns 1 for success, 0 for failure.

Async variant: `ContinueKeyboardAuthAsync` — same arguments, returns a `Task` (see Async variants below).

### SshTunnel.DisconnectAllClients

`Chilkat 11.7.0 · tcl · SshTunnel · DisconnectAllClients · method · since 9.5.0.50`

```tcl
# waitForThreads is a boolean

set status [CkSshTunnel_DisconnectAllClients $this $waitForThreads]
```

Disconnects all active tunnel clients while leaving the local listener and SSH connection available.

When `waitForThreads` is `1`, the method waits for the current client threads to exit before returning. The listener continues accepting new clients, and newly accepted clients can be forwarded normally.

Returns 1 for success, 0 for failure.

### SshTunnel.GetCurrentState

`Chilkat 11.7.0 · tcl · SshTunnel · GetCurrentState · method · since 9.5.0.65`

```tcl
# outStr is a CkString (output)

set status [CkSshTunnel_GetCurrentState $this $outStr]

set retStr [CkSshTunnel_getCurrentState $this]
```

Returns an XML snapshot describing the tunnel manager, SSH channels, and current tunnel clients. The returned data is intended for diagnostics and monitoring.

A typical result has the following structure:

```
<CurrentState>
  <tunnelManager rcvByteCount="433" sndByteCount="34"
      threadRunning="1" dynamicPortForwarding="0"
      staticDestHost="localhost" staticDestPort="18080">
    <openChannels count="1">
      <channel num="101" channelType="direct-tcpip"
          clientWinSize="2096927" serverWinSize="2097127" />
    </openChannels>
    <closedChannels count="0" />
  </tunnelManager>
  <clients count="1">
    <client destIp="localhost" destPort="18080"
        sshChannelNum="101" threadRunning="1"
        rcvByteCount="25" sndByteCount="225" />
  </clients>
</CurrentState>
```

The exact child elements can vary with state. For example, channel collections may be empty, and some transport details may be omitted before the tunnel is started or after it stops.

| Section | Information |
| :--- | :--- |
| `tunnelManager` | Aggregate byte counts, worker-thread state, forwarding mode, and configured fixed destination. |
| `openChannels` and `closedChannels` | SSH channel numbers, close/EOF flags, packet sizes, and flow-control window sizes. |
| `clients` | Per-client destination, SSH channel number, worker state, age/activity counters, pending-data flags, and byte counts. |

Returns 1 for success, 0 for failure.

### SshTunnel.IsSshConnected

`Chilkat 11.7.0 · tcl · SshTunnel · IsSshConnected · method · since 9.5.0.61`

```tcl
set retBool [CkSshTunnel_IsSshConnected $this]
```

Returns `1` when the SSH transport used by this tunnel is connected; otherwise returns `0`.

This is independent of the local listener state. The listener may still be accepting local TCP connections when this method returns `0`, but those connections cannot be forwarded until a usable SSH transport exists.

For a tunnel created with `ConnectThroughSsh`, this method becomes `0` when the borrowed first-hop `Ssh` connection is disconnected.

### SshTunnel.LoadTaskCaller

`Chilkat 11.7.0 · tcl · SshTunnel · LoadTaskCaller · method · since 9.5.0.80`

```tcl
# task is a CkTask

set status [CkSshTunnel_LoadTaskCaller $this $task]
```

Loads this object with the `SshTunnel` instance that initiated the asynchronous operation represented by `task`.

Returns 1 for success, 0 for failure.

### SshTunnel.SetAllowedAlgorithms

`Chilkat 11.7.0 · tcl · SshTunnel · SetAllowedAlgorithms · method · since 9.5.0.99`

```tcl
# json is a CkJsonObject

set status [CkSshTunnel_SetAllowedAlgorithms $this $json]
```

Restricts the SSH connection to the algorithms specified in `json`.

This allows an application to define the exact algorithm set that may be used during SSH negotiation.

Returns 1 for success, 0 for failure.

### SshTunnel.StartKeyboardAuth

`Chilkat 11.7.0 · tcl · SshTunnel · StartKeyboardAuth · method · since 9.5.0.78`

```tcl
# login is a string

# outStr is a CkString (output)

set status [CkSshTunnel_StartKeyboardAuth $this $login $outStr]

set retStr [CkSshTunnel_startKeyboardAuth $this $login]
```

Begins keyboard-interactive authentication for `login`.

When the server requests one or more responses, the returned XML contains the request name, instructions, and prompts:

```
<infoRequest numPrompts="N">
  <name>name text</name>
  <instruction>instruction text</instruction>
  <prompt1 echo="1_or_0">prompt text</prompt1>
  ...
  <promptN echo="1_or_0">prompt text</promptN>
</infoRequest>
```

The `echo` attribute indicates whether the response should be displayed while entered.

If authentication immediately succeeds or fails without requiring a response, the returned XML has one of these forms:

```
<success>success message</success>

<error>error message</error>
```

Pass the requested response or responses to `ContinueKeyboardAuth`.

Returns 1 for success, 0 for failure.

Async variant: `StartKeyboardAuthAsync` — same arguments, returns a `Task` (see Async variants below).

### SshTunnel.StopAccepting

`Chilkat 11.7.0 · tcl · SshTunnel · StopAccepting · method`

```tcl
# waitForThread is a boolean

set status [CkSshTunnel_StopAccepting $this $waitForThread]
```

Stops the local listener so that no new client connections are accepted. Existing forwarded clients remain connected and continue exchanging data.

- When `waitForThread` is `1`, the method waits for the listener thread to exit before returning.
- When it is `0`, shutdown is asynchronous and `IsAccepting` may remain `1` briefly after the method returns.

Call `BeginAccepting` again to resume accepting connections. The listener can be restarted on the same port after the previous listener has stopped.

Returns 1 for success, 0 for failure.

## Events and callbacks

This binding has no event callbacks. For progress, percent-done or cancellation use the `*Async` variant of a method and poll the returned `Task` (`PercentDone`, `Finished`, `Cancel`).

## Async variants

Each returns a `Task` instead of the result and takes the same arguments as the synchronous method; run the task, wait for `Finished`, then read the result from the task. No new Async methods are added from 11.7.0 on.

```tcl
# returns a CkTask

# username is a string

# privateKey is a CkSshKey

set ret_task [CkSshTunnel_AuthenticatePkAsync $this $username  $privateKey]
# returns a CkTask

# login is a string

# password is a string

set ret_task [CkSshTunnel_AuthenticatePwAsync $this $login  $password]
# returns a CkTask

# username is a string

# password is a string

# privateKey is a CkSshKey

set ret_task [CkSshTunnel_AuthenticatePwPkAsync $this $username  $password  $privateKey]
# returns a CkTask

# login is a CkSecureString

# password is a CkSecureString

set ret_task [CkSshTunnel_AuthenticateSecPwAsync $this $login  $password]
# returns a CkTask

# username is a CkSecureString

# password is a CkSecureString

# privateKey is a CkSshKey

set ret_task [CkSshTunnel_AuthenticateSecPwPkAsync $this $username  $password  $privateKey]
# returns a CkTask

# listenPort is an integer

set ret_task [CkSshTunnel_BeginAcceptingAsync $this $listenPort]
# returns a CkTask

# hostname is a string

# port is an integer

set ret_task [CkSshTunnel_ConnectAsync $this $hostname  $port]
# returns a CkTask

# ssh is a CkSsh

# hostname is a string

# port is an integer

set ret_task [CkSshTunnel_ConnectThroughSshAsync $this $ssh  $hostname  $port]
# returns a CkTask

# response is a string

set ret_task [CkSshTunnel_ContinueKeyboardAuthAsync $this $response]
# returns a CkTask

# login is a string

set ret_task [CkSshTunnel_StartKeyboardAuthAsync $this $login]
```

## Related classes

[`JsonObject`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/tcl/classes/JsonObject.md), [`SecureString`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/tcl/classes/SecureString.md), [`Ssh`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/tcl/classes/Ssh.md), [`SshKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/tcl/classes/SshKey.md), [`Task`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/tcl/classes/Task.md)