Technical Tip: Generate/Re-generate SSH Server Host Key in compliance with FIPS-CC

[heng]

Description	This article describes how to generate or re-generate SSH Server Host Key in the FortiManager/FortiAnalyzer OS in compliance with the operation management function with FIPS-CC. The encryption algorithm types ECDSA, EdDSA, and RSA will be generated.
Scope	FortiManager/FortiAnalyzer version 7.2.3 and above, version 7.4.0 and above.
Solution	To generate/Re-generate the SSH Server Host Key, run the following command in the CLI: execute ssh-regen-keys. An example run in FortiAnalyzer: execute ssh-regen-keys Regenerating SSH keys...done. To verify the keys being generated, check in the GUI under Dashboard -> Alert Message Console.  It is also possible to verify this under GUI -> System Settings -> Event Logs. id=7274506179345121282 bid=50480 dvid=1040 itime=1693727956 euid=1 epid=1 dsteuid=1 dstepid=1 log_id=0001010090 subtype=system type=event level=notice time=15:59:16 date=2023-09-03 user=sshd desc=SSH server regenerate host keys operation=Generate host key performed_on=SSH server changes=Generated new ECDSA host key tz=+0800 devid=FAZ-VM0000109999 devname=FAZ-74 id=7274506179345121281 bid=50481 dvid=1040 itime=1693727956 euid=1 epid=1 dsteuid=1 dstepid=1 log_id=0001010090 subtype=system type=event level=notice time=15:59:16 date=2023-09-03 user=sshd desc=SSH server regenerate host keys operation=Generate host key performed_on=SSH server changes=Generated new ED25519 host key tz=+0800 devid=FAZ-VM0000109999 devname=FAZ-74 id=7274506179345121280 bid=50480 dvid=1040 itime=1693727956 euid=1 epid=1 dsteuid=1 dstepid=1 log_id=0001010090 subtype=system type=event level=notice time=15:59:16 date=2023-09-03 user=sshd desc=SSH server regenerate host keys operation=Generate host key performed_on=SSH server changes=Generated new RSA host key tz=+0800 devid=FAZ-VM0000109999 devname=FAZ-74 id=7274506170755186688 bid=50480 dvid=1040 itime=1693727954 euid=1 epid=1 dsteuid=1 dstepid=1 log_id=0001010090 subtype=system type=event level=notice time=15:59:14 date=2023-09-03 user=admin userfrom=jsconsole(10.212.134.88) desc=SSH server regenerate host keys operation=Regenerate host keys performed_on=SSH server changes=Initiated regeneration of new SSH host keys tz=+0800 devid=FAZ-VM0000109999 devname=FAZ-74