Skip to main content
epb
epb
New Member
October 10, 2024
Question

Need to use ssh-rsa for Public Key authentication on Fortiswitches

  • October 10, 2024
  • 2 replies
  • 4318 views

I have a Fortiswitch 148E on FortiOS version 7.4.3 configured to accept public key authentication over SSH. I've found that I need to add "-o PubkeyAcceptedKeyTypes=+ssh-rsa" to my ssh command in order to successfully authenticate via public key as ssh-rsa is disabled by default in OpenSSH in favor of more secure algorithms. This seems like a bit of a security oversight on Fortinet's behalf. Is there any way to enable other public key algorithms in 7.4.3? Any chance this is resolved in 7.6?

2 replies

Atul_S
Staff & Editor
Atul_S
Staff & Editor
October 11, 2024

Hi,

 

ssh-rsa will no longer be offered as the server key host algorithm after upgrading to FortiOS v7.0.13 or FortiOS 7.2.6 and only offer the ssh-ed25519 algorithm. Please refer this info in detail in the below doc.

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSH-Server-host-key-offered-by-FortiGate/ta-p/279796

 

Thanks,

epb
epbAuthor
New Member
October 11, 2024

I'm on 7.4.3. Also, I don't think that document is relevant to Fortiswitches.

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
October 11, 2024

FortiSwitch 7.6.0 CLI reference guide says below:

 

ssh-public-key1/2/3 "<key‑type> <key‑value>"

 

 

You can specify the public keys of up to three SSH clients. These clients are authenticated without being asked for the administrator password. You must create the public-private key pair in the SSH client application.

<key type> is ssh-dss for a DSA key or ssh-rsa for an RSA key.

<key-value> is the public key string of the SSH client.


https://docs.fortinet.com/document/fortiswitch/7.6.0/fortiswitchos-cli-reference/500379/config-system#config4

So only other option would be DSS/DSA.

Toshi

epb
epbAuthor
New Member
October 11, 2024

I should be a little clearer about what I want to accomplish here. It's not simply that I don't want to use rsa (although it would be preferable to use more secure algorithms like ecsda), it's that I don't want to use rsa-sha1 for public key authentication, which is what is enabled when you add the "-o PubkeyAcceptedKeyTypes=+ssh-rsa" option. Without that option, it is my understanding that OpenSSH will still try to use rsa-sha2-256 or rsa-sha2-512.

Terms & ConditionsAccessibility statement