Technical Tip: SSH Cipher Hardening Verification on FortiWeb

Description

This article describes how to verify the SSH cipher suite used by FortiWeb units. FortiWeb uses a fixed SSH cipher set that cannot be modified or restricted through the GUI, CLI, or hidden commands. External enumeration is the supported method to validate active SSH ciphers.

Scope

FortiWeb.

Solution

1. Verify SSH ciphers using Nmap (Linux).

FortiWeb does not provide any command to display or configure SSH ciphers. SSH cipher enumeration must be performed externally. From an external host with network reachability to the FortiWeb management interface, run the command below:

nmap --script ssh2-enum-algos -p 22 <FortiWeb_IP>

This enumerates the SSH server’s supported algorithms, including:

• Key‑exchange algorithms.

• Host key algorithms.

• Encryption ciphers.

• MAC algorithms.

• Compression methods.

Example output (FortiWeb v8.0.6):

Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-08-05 11:58 CEST
Nmap scan report for 10.5.199.43
Host is up (0.028s latency).

PORT   STATE SERVICE
22/tcp open  ssh
| ssh2-enum-algos:
|   kex_algorithms: (11)
|       sntrup761x25519-sha512
|       sntrup761x25519-sha512@openssh.com
|       mlkem768x25519-sha256
|       curve25519-sha256
|       curve25519-sha256@libssh.org
|       diffie-hellman-group-exchange-sha256
|       diffie-hellman-group16-sha512
|       diffie-hellman-group18-sha512
|       diffie-hellman-group14-sha256
|       ext-info-s
|       kex-strict-s-v00@openssh.com
|   server_host_key_algorithms: (2)
|       rsa-sha2-512
|       ssh-ed25519
|   encryption_algorithms: (6)
|       chacha20-poly1305@openssh.com
|       aes128-ctr
|       aes192-ctr
|       aes256-ctr
|       aes128-gcm@openssh.com
|       aes256-gcm@openssh.com
|   mac_algorithms: (4)
|       hmac-sha2-256-etm@openssh.com
|       hmac-sha2-512-etm@openssh.com
|       hmac-sha2-256
|       hmac-sha2-512
|   compression_algorithms: (2)
|       none
|       zlib@openssh.com

This confirms the active SSH cipher suite used by FortiWeb.

2. Supported SSH behavior and security hardening.

• FortiWeb uses a fixed SSH cipher suite that cannot be modified.

• No GUI, CLI, or hidden commands exist to alter SSH cipher selection.

• SSH cipher configuration support is planned for FortiWeb v8.2.0, which will introduce the ability to modify and customize SSH cipher settings.

Recommended hardening measures:

• Restrict SSH access to trusted IP ranges.

• Bind SSH to dedicated management interfaces.