Fortigate SSH Server Generate New RSA Key Pair

[AtiT]

Hello,

Does anybody know how to generate a FortiGate SSH Server new RSA Key Pair - if it is possible at all.

Where is the default RSA key pair located on a FortiGate?

$ ssh -l admin x.x.x.x The authenticity of host 'x.x.x.x (x.x.x.x)' can't be established. RSA key fingerprint is 69:b7:62:fe:57:0b:bb:db:c3:87:bf:12:95:d0:c5:5d.

Are you sure you want to continue connecting (yes/no)? 

Thanks.

[user185953]

Yes, they should be same.

By the way, the easiest way to check they match is running "$ ssh-keyscan -t rsa" against both units

[emnoc]

Better would be to use  ssh -vvv  { from the client } , but I . believe the fingerprint are not the same across the cluster members or in my setup, they are NOT.!

[user185953]

Hi emnoc!

Actually ssh -vvv will use the default cipher, which is not ssh-rsa. Only ssh-rsa is synchronized per this topic.

Another disadvantage is, that it works only on one host at a time, while ssh-keyscan can take multiple hosts.

If you want the fingerprint instead of the full key, feel free to pipe it to ssh-keygen like this: ssh-keyscan -t rsa <host> | ssh-keygen  -l -f -

[emnoc]

Okay true if we are talking -t rsa, since you call that up with that option.I do not think in fortiOS the key are sync tho. I will check again. You could use the type and call up  ecdsa or other keys also, or grab the key from the  fortiOS directory and compare the file and size or md5sum.

Ken Felix

[user185953]

I'll be waiting for your results.

Out of curiousity, which FortiOS version will you be testing? The topic I linked is for v5.6.x

[AlexFeren]

Reviving this thread... Since upgrading from 6.0 to 6.4, at every reboot, Fortigate changes SSH public key. This Fortigate is meant to power cycle regularly, so, this SSH client warning is most unappreciated. How to prevent?

[user185953]

Hi AlexFeren,

I am running 6.4. and my ssh-rsa keys are stable. Are you sure you are checking the RSA keys?

Fortigates have two sets of SSH public keys: ssh-rsa and ssh-ed25519. SSH clients default to ssh-ed25519.

To find out ssh-rsa fingerprint: ssh-keyscan -t ssh-rsa <IPadresses> | ssh-keygen -lf-

To find out ssh-ed25519 fingerprint: ssh-keyscan -t ssh-ed25519 <IPadresses> | ssh-keygen -lf-

[AlexFeren]

Hi user185953,

yes, definitely - both change - after both, shutdown and reboot.

Is there a command to show public/private keys for administrative SSH session?

Alex

[user185953]

Well, that is concerning.

Do the keys change twice with two reboots in a row, or there is some kind of a "refresh interval" for the keys?

You can get public keys by "ssh-keyscan -t [ssh-rsa|ssh-ed25519] <IPadresses>" without the ssh-keygen part.

I think it would be a security bug if you could get the private key.

[AlexFeren]

user185953 wrote:
I think it would be a security bug if you could get the private key.

to get it from within Fortigate's administration session.