I'm not sure what to say about the Net::SSH issue, but I'm curious about this feature of the code you posted:

...
print header;
print start_html("Thank You");
print h2("Thank You");
...
print end_html;
...
print header;
... # (try to print stuff about ssh progress)
print end_html;
[download]

How is it that you expect to have two distinct HTML elements returned to the http client from a single run of this script? What do you expect the client to do with the second one? (I've never tried this, so I don't know.)

Apart from that, what would you expect to be the next thing that should happen after doing the ssh login, assuming that the login succeeds? As it is, it looks like there is nothing that can happen -- all you do there is "print end_html" and exit the process, which means that the ssh connection would need to shut down.

You say you want to "establish a secure connection to a server through CGI", but what do you really want to do, assuming such a connection should be made?

I have a hunch you are trying to do something that is basically impossible. CGI and web interactions generally are "stateless": client sends a "GET" or "POST" request to a server, server processes that, sends something back to the client, and that's it, period, end of process. Each such transaction is completely independent and isolated from other such transactions, unless special steps are taken at the server to maintain some record somewhere about particular clients and their particular requests (e.g. cookies, extra parameters in the html returned to the client, sessions, etc).

But in order to maintain an ssh login session on some host, the http server would need to preserve socket connections to that host, and somehow be able to access those sockets in accordance with subsequent transactions with the particular client. I wouldn't want to go there, even if it were possible to do so (which I doubt).

update: I just noticed this in one of your earlier replies:

In the long run I hope to use an HTML form to submit a job under a userid/password so that a job can execute as that user and return data to a directory owned by them.

I think you'll want to figure out an appropriate way to specify what job is supposed to be run, and use the "cmd" method in Net::SSH:Perl, which executes whatever command line you give it on the remote host, and returns the stdout, stderr and exit status.

Bear in mind that if the job being run takes a while, your cgi script will hang waiting for the return. If that becomes a problem, you'll need to settle on a way of having the command line return immediately, and making sure that its "real" output gets written to appropriate files. (There are several ways of doing this, including the use of redirection for stdout and stderr, and appending "&", at the end of the command line string.)