ssh-audit

Table of Contents

FortiOS >= 7.4.0
FortiOS >= 7.0.2 <= 7.4.0
FortiOS >= 5.6.0 <= 7.0.1
Limitations
Validated versions

FortiOS is an embedded operating system used on various appliances from Fortinet. Depending on the version of FortiOS, not all command may be available, and if major differences are known, they are combined in a specific section.

SSH into an appliance running FortiOS, or use a local serial connection in order to apply these options.

FortiOS >= 7.4.0

FortiOS 7.4 releases have introduced changes with individual releases, they are summarized into a single section:

7.4.2: set ssh-hostkey-algo modified, it allows configuring more KEX algorithms than in previous releases
7.4.1: set ssh-kex-algo modified, it allows configuring more KEX algorithms than in previous releases
7.4.0: set ssh-hostkey-algo added, it allows configuring one or more SSH host key algorithms

config system global

# These commands shoulnd't change default settings
set admin-ssh-v1 disable
set strong-crypto enable

# These commands do change default settings
set dh-params 8192
set ssh-enc-algo chacha20-poly1305@openssh.com aes256-gcm@openssh.com
set ssh-hostkey-algo ssh-ed25519
set ssh-kex-algo diffie-hellman-group16-sha512 diffie-hellman-group18-sha512 curve25519-sha256@libssh.org
set ssh-mac-algo hmac-sha2-256-etm@openssh.com hmac-sha2-512-etm@openssh.com

end

References:

Fortinet document library: FortiGate / FortiOS 7.4.2 CLI Reference > config system global:
- ssh-hostkey-algo allows enabling or disabling 7 HostKeyAlgorithms
Fortinet document library: FortiGate / FortiOS 7.4.1 CLI Reference > config system global:
- ssh-hostkey-algo allows enabling or disabling 5 HostKeyAlgorithms
- ssh-kex-algo allows enabling or disabling 11 KEX algorithms
Fortinet document library: FortiGate / FortiOS 7.4.0 CLI Reference > CLI reference > config system global:
- ssh-hostkey-algo becomes available
- ssh-kex-algo allows enabling or disabling 8 KEX algorithms
Fortinet document library: FortiGate / FortiOS 7.2.5 CLI Reference > CLI reference > config system global:
- ssh-hostkey-algo is not available

FortiOS >= 7.0.2 <= 7.4.0

Starting with FortiOS 7.0.2 some ciphers became individually configurable, several options have been renamed compared to previous versions.

config system global

# These commands shoulnd't change default settings
set admin-ssh-v1 disable
set strong-crypto enable

# These commands do change default settings
set dh-params 8192
set ssh-enc-algo chacha20-poly1305@openssh.com aes256-gcm@openssh.com
set ssh-kex-algo curve25519-sha256@libssh.org
set ssh-mac-algo hmac-sha2-256-etm@openssh.com hmac-sha2-512-etm@openssh.com

end

References

Fortinet document library: FortiGate / FortiOS 7.0.0 > New Features > Enabling individual ciphers in the SSH administrative access protocol
Fortinet document library: FortiGate / FortiOS 7.0.2 > CLI reference > config system global:
- Previous commands like set ssh-kex-sha1 are not available anymore.
- New commands like set ssh-kex-algo have been introduced.
Fortinet document library: FortiGate / FortiOS 7.0.1 > CLI reference > config system global:
- Commands like set ssh-key-sha1 are still available.

FortiOS >= 5.6.0 <= 7.0.1

Starting with FortiOS 5.6 strong-crypto defaults to enable while SSHv1 defaults to disable since at least FortiOS 5.0.

config system global

# These commands shoulnd't change default settings
set admin-ssh-v1 disable
set strong-crypto enable

# These commands do change default settings
set dh-params 8192
set ssh-cbc-cipher disable
set ssh-hmac-md5 disable
set ssh-kex-sha1 disable
set ssh-mac-weak disable

end

References

Fortinet document library: FortiGate / FortiOS 5.6.0 > CLI Reference: Page 569, strong-crypto defaults to enable
Fortinet document library: FortiGate / FortiOS 5.4.0 > CLI Reference: Page 163-164, strong-crypto defaults to disable
Fortinet document library: FortiGate / FortiOS 5.0.0 > CLI Reference: Page 527, admin-ssh-v1 defaults to disable. This is the earliest reference found, newer versions stick to the same default.

Limitations

In most versions of FortiOS the configuration options available don't permit reaching a perfect score, here are some of the reasons:

Ciphers: Only after FortiOS 7.0.2 certain ciphers can be individually enabled and disabled.
Host-key algorithms: Only pretty recent FortiOS version 7.4.1 or later permit configuring host keys algorithms, therefore rsa-sha2-256 and rsa-sha2-512 cannot be disabled in older releases.

Validated versions

FortiOS	ssh-audit
7.4.1	master @ 02ab487232de438c0811116f2676cb1c9b5f3d62
7.2.5	master @ 02ab487232de438c0811116f2676cb1c9b5f3d62
7.0.12	master @ 02ab487232de438c0811116f2676cb1c9b5f3d62
7.0.11	master @ 02ab487232de438c0811116f2676cb1c9b5f3d62