Troubleshooting Tip: Scheduled remote backup does not generate on SFTP server after FortiMail upgrade

As of FortiMail v7.2.5GA and 7.4.2GA, 'ssh-rsa' is removed from the 'strong-crypto' list for sshd.  If FortiMail and the SFTP server were using 'ssh-rsa' to establish an SSH tunnel,  after upgrading FortiMail to v7.2.5GA and 7.4.2GA, the SFTP scheduled remote backup will fail.

As a workaround, disable the 'strong-crypto' option, which enables 'ssh-rsa':

config global

    set strong-crypto disable

end

Enabling 'strong-crypto' can disable some Key Exchange Algorithms (KexAlgorithms), potentially causing SFTP connection failures. Capture a PCAP file to verify the keys exchanged between the SSH/SFTP client and server

===== SSH1 ======

# prepare a packet sniffer:

diagnose sniffer packet any "x.x.x.x" 6 0 a #   <----- x.x.x.x is the address of the sftp server.

===== SSH2 ======

# trigger a remote backup:

execute backup full-config scp data/backup/fortimail/FML_SN/test_fml.conf x.x.x.x username password"

Use the captured PCAP file to identify the Key Exchange Algorithm negotiated by the client, and add it to the SFTP server’s list of supported KexAlgorithms.