| Solution |
As of FortiMail v7.2.5GA and 7.4.2GA, 'ssh-rsa' is removed from the 'strong-crypto' list for sshd. If FortiMail and the SFTP server were using 'ssh-rsa' to establish an SSH tunnel, after upgrading FortiMail to v7.2.5GA and 7.4.2GA, the SFTP scheduled remote backup will fail.
As a workaround, disable the 'strong-crypto' option, which enables 'ssh-rsa':
config global
set strong-crypto disable
end
As a secure and long-term solution, configure the SFTP server to use the following algorithms and enable the 'strong-crypto' on FortiMail:
fml # print gzfile /etc/ssh/ssh_config
Protocol 2
UserKnownHostsFile=/dev/null
StrictHostKeyChecking no
LogLevel error
Ciphers aes128-cbc,aes256-cbc,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,chacha20-poly1305@openssh.com
MACs hmac-sha2-512,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com
KexAlgorithms ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
HostKeyAlgorithms rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-ed25519
Also, when 'strong-crypto' is enabled, some Key Exchange Algorithms (KexAlgorithms) are disabled, which could also cause SFTP connection failure. To check exchanged keys between the SSH/SFTP client and server, capture a PCAP file:
===== SSH1 ======
# prepare a packet sniffer:
diagnose sniffer packet any "x.x.x.x" 6 0 a # <----- x.x.x.x is the address of the sftp server.
===== SSH2 ======
# trigger a remote backup:
execute backup full-config scp data/backup/fortimail/FML_SN/test_fml.conf x.x.x.x username password"
|
