Need to use ssh-rsa for Public Key authentication on Fortiswitches

[epb]

I have a Fortiswitch 148E on FortiOS version 7.4.3 configured to accept public key authentication over SSH. I've found that I need to add "-o PubkeyAcceptedKeyTypes=+ssh-rsa" to my ssh command in order to successfully authenticate via public key as ssh-rsa is disabled by default in OpenSSH in favor of more secure algorithms. This seems like a bit of a security oversight on Fortinet's behalf. Is there any way to enable other public key algorithms in 7.4.3? Any chance this is resolved in 7.6?

[Atul_S]

Hi,

ssh-rsa will no longer be offered as the server key host algorithm after upgrading to FortiOS v7.0.13 or FortiOS 7.2.6 and only offer the ssh-ed25519 algorithm. Please refer this info in detail in the below doc.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSH-Server-host-key-offered-by-FortiGate/t...

Thanks,

[epb]

I'm on 7.4.3. Also, I don't think that document is relevant to Fortiswitches.

[Toshi_Esumi]

FortiSwitch 7.6.0 CLI reference guide says below:

ssh-public-key1/2/3 "<key‑type> <key‑value>"

You can specify the public keys of up to three SSH clients. These clients are authenticated without being asked for the administrator password. You must create the public-private key pair in the SSH client application.

<key type> is ssh-dss for a DSA key or ssh-rsa for an RSA key.

<key-value> is the public key string of the SSH client.

https://docs.fortinet.com/document/fortiswitch/7.6.0/fortiswitchos-cli-reference/500379/config-syste...

So only other option would be DSS/DSA.

Toshi

[epb]

I should be a little clearer about what I want to accomplish here. It's not simply that I don't want to use rsa (although it would be preferable to use more secure algorithms like ecsda), it's that I don't want to use rsa-sha1 for public key authentication, which is what is enabled when you add the "-o PubkeyAcceptedKeyTypes=+ssh-rsa" option. Without that option, it is my understanding that OpenSSH will still try to use rsa-sha2-256 or rsa-sha2-512.