sgcSSH Feature Matrix
Everything sgcSSH does, mapped across the three client components, the two server components and the algorithms they negotiate. The same classes exist in Delphi and .NET, and every license ships full source code.
Everything sgcSSH does, mapped across the three client components, the two server components and the algorithms they negotiate. The same classes exist in Delphi and .NET, and every license ships full source code.
Commands, shells, forwarding and rekey
Fast transfers, 16 requests in flight
Files and whole folders
Authentication, exec, shell and subsystems
A jail per user, read only mode
Post-quantum key exchange first
Delphi 7 to 13 and .NET
sgcSSH is self-contained. It ships with the sgcWebSockets Core runtime bundled in, and the sgcCustomIndy add-on the Delphi components build on is always included in the order.
Also inside sgcWebSockets. All five components also ship inside sgcWebSockets Enterprise, and All-Access includes everything. On .NET they are part of the registered package, not the free Community edition. sgcSSH is the standalone package for teams that only need SSH and SFTP.
Three clients and two servers, registered on the SGC SSH palette page.
| Component | Class | Job | Description |
|---|---|---|---|
| SSH Client | TsgcSSHClient | Run commands | Remote commands, an interactive shell with a pty, local and remote port forwarding, and rekeying of long running sessions. |
| SFTP Client | TsgcSFTPClient | Transfer files | SFTP v3 file manager operations with 16 requests in flight, so a 100 MB transfer takes about one second on a local network. |
| SCP Client | TsgcSCPClient | Copy files and folders | Uploads and downloads single files or whole folder trees with scp, optionally keeping the file times. |
| SSH Server | TsgcSSHServer | Accept SSH clients | Password and public key authentication, exec, shell and subsystem requests, with Ed25519, ECDSA and RSA host keys. |
| SFTP Server | TsgcSFTPServer | Serve a folder | SFTP v3 and SCP from a root folder, with a jail per user, a read only mode and an event to allow or deny each operation. |
TsgcSSHClient opens one authenticated SSH connection and runs as many channels on it as you need.
| Capability | API | Notes |
|---|---|---|
| Connection | Host, Port, Connect, Disconnect | Port 22 by default. |
| Password authentication | Authentication.Username, Authentication.Password | Plain user name and password sign-in. |
| Public key authentication | Authentication.PrivateKeyFile, Authentication.Passphrase | Ed25519, ECDSA and RSA private keys in PEM or PKCS#8 files, and also in the OpenSSH format on .NET. |
| Host key check | OnSSHHostKey | Receives the key type and its fingerprint, so you compare them with your known hosts store and reject an unknown or changed key. |
| Remote command | Execute | Opens a channel, runs the command and returns its output as a string, with a timeout. |
| Interactive shell | OpenChannel, RequestPTY, RequestShell | A terminal session with the terminal type and size you choose. |
| Shell input and output | SendChannelData, OnSSHChannelData | Send what the user types, receive what the server prints. |
| Terminal control | SendWindowChange, SendSignal, SendEOF | Resize the terminal, send a signal or end the input of a channel. |
| Exec and subsystem channels | RequestExec, RequestSubsystem | Low level channel requests for custom protocols over SSH. |
| Local port forwarding | OpenDirectTCPIP | Opens a direct-tcpip channel to a host and port reachable from the server. |
| Remote port forwarding | RequestForwarding, CancelForwarding | Asks the server to listen on a port and forward its connections back to the client. |
| Rekey | Rekey | Renews the session keys of a long running connection. |
| Post-quantum key exchange | PostQuantumKex | On by default: offers mlkem768x25519-sha256 first. |
TsgcSFTPClient implements SFTP v3 over the same SSH transport, with the same authentication and key exchange options as the SSH client.
| Capability | API | Notes |
|---|---|---|
| Home folder | RealPath | Resolves a path such as . to the absolute path on the server. |
| Folder listing | ListDirectory | Name, size, modification date and folder flag of every entry. |
| Upload and download | Put, Get | One call per file, with 16 requests in flight. A 100 MB transfer takes about one second on a local network. |
| File management | Rename, Delete, MakeDirectory, RemoveDirectory | Everything a file manager needs. |
| Progress | OnSFTPProgress | Reports the bytes transferred, ready for a progress bar. |
TsgcSCPClient copies files over SSH to any server that allows the scp command.
| Capability | API | Notes |
|---|---|---|
| Single files | Upload, Download | Copy one file to or from the remote path. |
| Folder trees | UploadFolder, DownloadFolder | Copy a whole folder recursively. |
| File times | PreserveTimes | Keeps the modification and access times on the other side. |
| Progress | OnSCPProgress | Reports the file name and the bytes transferred. |
TsgcSSHServer accepts any standard SSH client, the ssh, sftp and scp command line tools included.
| Capability | API | Notes |
|---|---|---|
| Listening | Port, Active | Start and stop the server. |
| Host keys | HostKeyFiles, GenerateHostKeyEd25519 | Ed25519, ECDSA and RSA host keys. The class procedure creates an Ed25519 key file for you. |
| Password authentication | OnSSHAuthPassword | Check the user name and password against your own user store. |
| Public key authentication | OnSSHAuthPublicKey | Receives the key type and its SHA256 fingerprint, so you accept only the keys you know. |
| Remote commands | OnSSHExec, SendChannelData, SendExitStatus, CloseChannel | Answer a command, report its exit status and close the channel. |
| Interactive shell | OnSSHShell, OnSSHChannelData | Serve a terminal session from your own code. |
| Subsystems | SFTPServer | Subsystem requests such as sftp are routed to a linked TsgcSFTPServer. |
| Connection events | OnSSHConnect, OnSSHDisconnect | Log every connection with the peer address. |
TsgcSFTPServer plugs into TsgcSSHServer and serves files from a folder that clients cannot leave.
| Capability | API | Notes |
|---|---|---|
| Protocols | SFTP, SCP | SFTP v3, plus scp transfers when enabled. |
| Root folder | RootFolder | The folder shown to the clients. Paths outside it are refused. |
| One folder per user | OnSFTPUserRoot | Return the root of each user, so every user sees only its own files. |
| Read only mode | ReadOnly | Refuses uploads, deletes and renames. |
| Per operation control | OnSFTPOperation | Fires for every open for read or write, remove, rename, folder creation and removal, attribute change and listing. Set aAccept to False and the client gets a permission denied error. |
| Large downloads | Flow control | Downloads use constant memory, whatever the file size. |
Client and server offer the strongest algorithms first and fall back to the classic ones only when the other side needs them.
| Area | Algorithms | Notes |
|---|---|---|
| Key exchange | mlkem768x25519-sha256 | ML-KEM-768 combined with X25519, the default of the latest SSH releases. Offered first by the client and by the server. |
| Classic key exchange | curve25519, ECDH, Diffie-Hellman group14 and group16 | Used when the other side does not support the hybrid exchange. |
| Ciphers | AES-GCM, AES-CTR | AES-GCM is hardware accelerated on .NET 8 and later. |
| Host and user keys | Ed25519, ECDSA, RSA | RSA signatures with SHA-2, selected through server-sig-algs. |
| Key files | PEM, PKCS#8, OpenSSH (.NET) | Encrypted private keys are opened with a passphrase. |
| Strict key exchange | Terrapin mitigation | Closes the prefix truncation attack on the SSH handshake. |
The same five components on Delphi and .NET.
| Area | Detail |
|---|---|
| Delphi | Delphi 7 through 13, for VCL, FMX, console applications and services. |
| Delphi targets | Windows Win32, Windows Win64 and Linux64. |
| .NET | .NET 8, .NET 9, .NET 10 and .NET Standard 2.0, in fully managed code with no OpenSSL. |
| Demos | Demos\27.SSH: SSH client, SFTP client, SCP client, SSH server and SFTP server. |
| Editions | All five components also ship inside sgcWebSockets Enterprise, and All-Access includes everything. On .NET they ship in the registered package, not in the Community edition. |
| Licensing | Standalone. The sgcWebSockets Core runtime is bundled in, sgcCustomIndy is included in the order and full source code is included. |