Technical Tip: Enabling individual ciphers in the SSH administrative access protocol in FortiProxy.

[ssriswadpong]

Description	This article describes how to enable individual ciphers in the SSH administrative access protocol in FortiProxy.
Scope	FortiProxy.
Solution	If a vulnerability scanner tool reports weak algorithms are enabled in FortiProxy, specific algorithms can be allowed by following commands. These commands has been added in 7.0.1. config system global set ssh-enc-algo {chacha20-poly1305@openssh.com aes128-ctr aes192-ctr aes256-ctr arcfour256 arcfour128 aes128-cbc 3des-cbc blowfish-cbc cast128-cbc aes192-cbc aes256-cbc arcfour rijndael-cbc@lysator.liu.se aes128-gcm@openssh.com aes256-gcm@openssh.com}  set ssh-kex-algo {diffie-hellman-group14-sha1 diffie-hellman-group-exchange-sha1 diffie-hellman-group-exchange-sha256 curve25519-sha256@libssh.org ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521} set ssh-mac-algo {hmac-md5 hmac-md5-etm@openssh.com hmac-md5-96 hmac-md5-96-etm@openssh.com hmac-sha1 hmac-sha1-etm@openssh.com hmac-sha2-256 hmac-sha2-256-etm@openssh.com hmac-sha2-512 hmac-sha2-512-etm@openssh.com hmac-ripemd160 hmac-ripemd160@openssh.com hmac-ripemd160-etm@openssh.com umac-64@openssh.com umac-128@openssh.com umac-64-etm@openssh.com umac-128-etm@openssh.com} end Note: Starting from v7.4.4, the ssh-xxx-algo commands have been moved from 'config system global setting' to 'config system ssh-config setting'.