Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
AtiT
Valued Contributor

Fortigate SSH Server Generate New RSA Key Pair

Hello,

Does anybody know how to generate a FortiGate SSH Server new RSA Key Pair - if it is possible at all.

Where is the default RSA key pair located on a FortiGate?

 

$ ssh -l admin x.x.x.x The authenticity of host 'x.x.x.x (x.x.x.x)' can't be established. RSA key fingerprint is 69:b7:62:fe:57:0b:bb:db:c3:87:bf:12:95:d0:c5:5d.

Are you sure you want to continue connecting (yes/no)? 

 

Thanks.

AtiT

AtiT
28 REPLIES 28
user185953

Yes, they should be same.

 

By the way, the easiest way to check they match is running "$ ssh-keyscan -t rsa" against both units

emnoc
Esteemed Contributor III

Better would be to use  ssh -vvv  { from the client } , but I . believe the fingerprint are not the same across the cluster members or in my setup, they are NOT.!

 

 

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
user185953

Hi emnoc!

Actually ssh -vvv will use the default cipher, which is not ssh-rsa. Only ssh-rsa is synchronized per this topic.

Another disadvantage is, that it works only on one host at a time, while ssh-keyscan can take multiple hosts.

If you want the fingerprint instead of the full key, feel free to pipe it to ssh-keygen like this: ssh-keyscan -t rsa <host> | ssh-keygen  -l -f -

emnoc
Esteemed Contributor III

Okay true if we are talking -t rsa, since you call that up with that option.I do not think in fortiOS the key are sync tho. I will check again. You could use the type and call up  ecdsa or other keys also, or grab the key from the  fortiOS directory and compare the file and size or md5sum.

 

 

Ken Felix

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
user185953

I'll be waiting for your results.

Out of curiousity, which FortiOS version will you be testing? The topic I linked is for v5.6.x

AlexFeren
New Contributor III

Reviving this thread... Since upgrading from 6.0 to 6.4, at every reboot, Fortigate changes SSH public key. This Fortigate is meant to power cycle regularly, so, this SSH client warning is most unappreciated. How to prevent?

user185953

Hi AlexFeren,

I am running 6.4. and my ssh-rsa keys are stable. Are you sure you are checking the RSA keys?

Fortigates have two sets of SSH public keys: ssh-rsa and ssh-ed25519. SSH clients default to ssh-ed25519.

To find out ssh-rsa fingerprint: ssh-keyscan -t ssh-rsa <IPadresses> | ssh-keygen -lf-

To find out ssh-ed25519 fingerprint: ssh-keyscan -t ssh-ed25519 <IPadresses> | ssh-keygen -lf-

AlexFeren
New Contributor III

Hi user185953,

yes, definitely - both change - after both, shutdown and reboot.

Is there a command to show public/private keys for administrative SSH session?

Alex

user185953

Well, that is concerning.

Do the keys change twice with two reboots in a row, or there is some kind of a "refresh interval" for the keys?

 

You can get public keys by "ssh-keyscan -t [ssh-rsa|ssh-ed25519] <IPadresses>" without the ssh-keygen part.

I think it would be a security bug if you could get the private key.

AlexFeren
New Contributor III

user185953 wrote:
I think it would be a security bug if you could get the private key.

 

to get it from within Fortigate's administration session.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors