sgcSSH: SSH & SFTP Clients and Servers for Delphi & .NET
Five components cover both ends of an SSH connection. TsgcSSHClient runs remote commands, opens an interactive shell with a pty and forwards ports. TsgcSFTPClient and TsgcSCPClient move files and whole folders. TsgcSSHServer and TsgcSFTPServer put your own SSH and SFTP service inside your application, with a jail per user. The hybrid post-quantum key exchange mlkem768x25519-sha256, the default of the latest SSH releases, is offered first by the client and by the server.
Key exchangeML-KEM-768 + X25519mlkem768x25519-sha256, offered first on both sides
ClientsSSH, SFTP, SCP
ServersSSH, SFTP
5ComponentsThree clients and two servers
16SFTP requests in flightA 100 MB transfer takes about one second on a local network
2LanguagesDelphi and .NET, the same five classes
100%Source code includedEvery component and the bundled Core runtime
12Months of updatesEvery release published while your license is active
BEFORE YOU BUY
Three Things Worth Knowing First
What sgcSSH needs from you, whether you already own these components, and what the Delphi version builds on. All three answers are short.
sgcSSH is self-contained
Standalone, the sgcWebSockets Core runtime is included, together with the native cryptography the key exchange runs on: ML-KEM-768, X25519, ECDH, AES-GCM and the SHA-2 family. One SKU, one installer.
Full source code ships with every license, so the protocol code steps through in your own debugger rather than disappearing into a binary.
Edition overlap
Already in your sgcWebSockets edition?
All five SSH components ship inside sgcWebSockets Enterprise, and All-Access includes everything. On .NET they ship in the registered sgcWebSockets package, not in the free Community edition.
sgcSSH exists for the opposite case: you want SSH and SFTP in your application without licensing a full sgcWebSockets edition. Check what your edition already covers before you buy.
Add-on required
Delphi SSH needs sgcCustomIndy
The Delphi components are built on the SSH units of the patched Indy library that sgcCustomIndy ships as an add-on. sgcCustomIndy is always included when you order sgcSSH.
The sgcSSH price shown already covers sgcCustomIndy.
WHAT IS IN THE BOX
Three Clients, Two Servers
Each one is a non-visual component you drop on a form or create in code, registered on the SGC SSH palette page. Set the host and the credentials, wire the events, then connect or start listening. The .NET classes carry the same names.
SSH client1 component
Commands, shells and tunnels
TsgcSSHClient connects with a password or a private key, and OnSSHHostKey hands you the host key type and fingerprint to check against your known hosts store. Execute runs a command and returns its output in one call. For an interactive session, OpenChannel, RequestPTY and RequestShell open a terminal, SendChannelData types into it and OnSSHChannelData returns what the server prints, with SendWindowChange and SendSignal for the rest of the terminal protocol. OpenDirectTCPIP forwards a local connection through the server, RequestForwarding asks the server to forward a remote port back to you, and Rekey renews the session keys of a long running connection.
TsgcSSHClientexec · shell · pty · port forwarding · rekey
SFTP client1 component
Fast file transfers, one method each
TsgcSFTPClient speaks SFTP v3 over the same SSH connection. RealPath resolves the home folder, ListDirectory returns names, sizes, dates and the folder flag, and Put and Get upload and download a file in one call. Rename, Delete, MakeDirectory and RemoveDirectory cover the rest of a file manager, and OnSFTPProgress reports the bytes transferred for a progress bar. Transfers keep 16 requests in flight instead of waiting for each block, so a 100 MB file takes about one second on a local network.
TsgcSCPClient copies files over SSH to any server that allows the scp command, without a separate file transfer service. Upload and Download copy one file, UploadFolder and DownloadFolder copy a whole folder tree recursively, and PreserveTimes keeps the modification and access times on the other side. OnSCPProgress reports the file name and the bytes transferred.
TsgcSSHServer listens on the port you choose and proves its identity with Ed25519, ECDSA or RSA host keys loaded from HostKeyFiles, and GenerateHostKeyEd25519 creates one for you. OnSSHAuthPassword and OnSSHAuthPublicKey decide who gets in, the second one with the key type and its SHA256 fingerprint. OnSSHExec answers remote commands, OnSSHShell serves an interactive session, and subsystem requests are routed to your handler or to TsgcSFTPServer. Any standard SSH client connects to it, including the standard ssh, sftp and scp command line tools.
TsgcSSHServerpassword · public key · exec · shell · subsystems
SFTP server1 component
A file server with a jail per user
TsgcSFTPServer links to the SSH server through its SFTPServer property and serves SFTP v3 and, with SCP enabled, scp transfers from RootFolder. Clients cannot leave it. OnSFTPUserRoot gives every user a folder of its own, ReadOnly refuses uploads, deletes and renames, and OnSFTPOperation fires for every open, remove, rename, folder change, attribute change and listing, so you allow or deny each one and log it. Flow control keeps the memory of a large download constant, whatever the file size.
The components are ordinary non-visual components, so they slot into whatever your application already is: a VCL or FMX desktop app, a console tool, a Windows service, a Linux daemon or a .NET worker. These are the patterns customers build, each mapped to the member that drives it.
EX
Run maintenance commands on Linux serversExecute
Restart a service, read a log or check disk space from a Delphi or .NET tool, and get the output back as a string.
TM
An embedded terminal windowRequestPTY
Open a shell with a pty and show it in your own UI, for support tools and device consoles.
FT
Scheduled file exchange with partnersPut / Get
Upload invoices and download reports over SFTP from a service, with progress and error events.
TN
Reach a database behind a bastion hostOpenDirectTCPIP
Forward a connection through the SSH server instead of opening the database port to the network.
SV
An SFTP drop box inside your productOnSFTPUserRoot
Give every customer a private folder, with your own user database deciding who signs in.
PQ
Traffic that stays private in the futurePostQuantumKex
The hybrid ML-KEM-768 and X25519 exchange protects sessions recorded today against a future quantum computer.
HOW IT WORKS
Post-Quantum First, Modern Algorithms Only
Client and server negotiate the strongest algorithms both sides support, starting with the hybrid post-quantum key exchange. Nothing needs to be configured to get it.
mlkem768x25519-sha256 is offered first
The hybrid exchange combines ML-KEM-768 with X25519, so the session keys stay safe even against an attacker who records the traffic today and owns a quantum computer later. It is the default of the latest SSH releases, and current SSH clients and servers negotiate it automatically. PostQuantumKex is on by default.
Classic algorithms as the fallback
When the other side does not support it, the exchange falls back to curve25519, ECDH and Diffie-Hellman group14 and group16. The ciphers are AES-GCM and AES-CTR, and host keys and user keys are Ed25519, ECDSA or RSA.
Strict key exchange against Terrapin
Strict key exchange closes the Terrapin prefix truncation attack, and server-sig-algs lets the client pick an RSA signature with SHA-2 instead of the legacy SHA-1 one. Private keys load from PEM and PKCS#8 files, and the .NET version also reads the OpenSSH key format.
Native cryptography on both platforms
The key exchange runs on the sgcWebSockets native cryptography units in Delphi and on fully managed code in .NET, with no OpenSSL to deploy for the .NET version. On .NET 8 and later AES-GCM is hardware accelerated.
QUICK START
Run a Command, Serve a Folder
The clients follow one shape: set the host and the credentials, connect, call a method. The servers follow another: set the port and the host key, wire the events, activate.
var
SSH: TsgcSSHClient;
SFTP: TsgcSFTPClient;
begin// run a command
SSH := TsgcSSHClient.Create(nil);
SSH.Host := 'build01.example.com';
SSH.Port := 22;
SSH.Authentication.Username := 'deploy';
SSH.Authentication.PrivateKeyFile := 'C:\keys\id_ed25519.pem';
SSH.OnSSHHostKey := SSHHostKey; // check the fingerprint
SSH.Connect;
Memo1.Text := SSH.Execute('uname -a');
SSH.Disconnect;
// upload a file over SFTP
SFTP := TsgcSFTPClient.Create(nil);
SFTP.Host := 'files.example.com';
SFTP.Authentication.Username := 'partner';
SFTP.Authentication.Password := 'secret';
SFTP.Connect;
SFTP.Put('C:\export\invoices.zip', '/upload/invoices.zip');
SFTP.Disconnect;
end;
PostQuantumKex is on by default, so both sessions negotiate mlkem768x25519-sha256 whenever the server supports it.
begin
SFTPServer := TsgcSFTPServer.Create(nil);
SFTPServer.RootFolder := 'D:\sftp';
SFTPServer.SFTP := True;
SFTPServer.SCP := True;
SFTPServer.OnSFTPUserRoot := SFTPUserRoot;
SSHServer := TsgcSSHServer.Create(nil);
SSHServer.Port := 2222;
SSHServer.HostKeyFiles.Text := 'hostkey_ed25519.pem';
SSHServer.OnSSHAuthPassword := SSHAuthPassword;
SSHServer.SFTPServer := SFTPServer;
SSHServer.Active := True;
end;
procedure TForm1.SSHAuthPassword(Sender: TObject;
aConnection: TsgcSSHServerConnection; const aUsername, aPassword: string;
var aAccept: Boolean);
begin
aAccept := CheckUser(aUsername, aPassword); // your user storeend;
procedure TForm1.SFTPUserRoot(Sender: TObject; const aUsername: string;
var aRootFolder: string);
begin
aRootFolder := 'D:\sftp\' + aUsername; // one jail per userend;
Connect with sftp -P 2222 user@127.0.0.1 or scp -P 2222 file.txt user@127.0.0.1:/. The demos in Demos\27.SSH cover all five components.
PLATFORMS
Delphi and .NET, Desktop and Server
The same five components on both platforms, for desktop applications, console tools and services.
DelphiDelphi 7 to 13, VCL, FMX, console and services
sgcSSH is licensed on its own, starting at €398 for a single developer. All licenses include full source code, 1 year of updates and a 50% to 70% renewal discount: 50% when you renew one pack, 60% for two, 70% for three or more. sgcAI, sgcMQ, sgcSocial, sgcCustomIndy, sgcAuth, sgcHTTP, sgcREST, sgcCrypto and sgcSSH each count as a pack.
sgcSSH
€398
Single, Team and Site licenses available.
SSH client: commands, shell with pty, port forwarding, rekey
SFTP and SCP clients for files and folders
SSH and SFTP servers with a jail per user
Post-quantum key exchange mlkem768x25519-sha256
sgcWebSockets Core runtime and sgcCustomIndy included
Delphi 7 to 13 & .NET
Full source code
1 year of updates
sgcSSH includes the sgcWebSockets Core runtime, so there is nothing else to buy for the SSH and SFTP components.
Checkout lists three items: the sgcWebSockets Core runtime entitlement, which is charged at zero, the sgcSSH pack itself, and sgcCustomIndy, which the Delphi SSH components require. sgcCustomIndy is always included and the price shown already covers it. Full pricing details.
3,000+Developers
20+Years
761+Components
30+API Integrations
5Platforms
30-Day Money-Back GuaranteeNot satisfied? Request a full refund within 30 days of purchase. See refund policy
Ship SSH and SFTP, Ready for the Post-Quantum Era
Clients and servers from native Delphi and .NET code, with the runtime bundled in and full source code in the box. Download the All-Access trial installer and connect to your first server today.
The custom Indy library sgcWebSockets Enterprise is built on, packaged as an add-on. Required by the Delphi SSH components, always included in sgcSSH orders.