Public key SSH access

Public-private key pairs can be used to authenticate administrators connecting to the CLI using an SSH client. These keys can be RSA, ECDSA, or EdDSA.

Weigh the pros and cons of using key-pair authentication, versus passwords, when considering their use:

	Key-pair	Password
Pros	More secure (higher complexity)	Easy to remember
	Restricts logon to hosts that have the private key	Easy to update
	Never sent to the FortiGate	Can log in from any system
	Can add a password in addition to the key
Cons	More complex to implement	Might be guessable or brute forced
	The private key is only as secure as the system storing it	Could be reused and compromised on another system
	More complicated to train users and administrators to use keys	Might be stored in plain text on an authenticating device (This does not apply to FortiGates)
		Can be phished or observed if written down

Key-pair authentication is often implemented when connecting to the FortiGate without any human interaction, such as when using a script. The script can leverage existing mechanisms to secure private keys, instead of trying to develop a way to securely store a username and password.

Generating the key pair

Key pairs can be generated and added in multiple different ways. This example shows generating a key pair using PuTTY Key Generator and adding the private key to the endpoint using PuTTY Pageant.

To create the key pair using PuTTY:

1. Download and install PuTTY.

2. Run PuTTYgen.exe.

3. Set Type of key to generate to RSA, ECDSA, or EdDSA.

4. Click Generate, then move the mouse cursor around in the blank space to generate randomness while the keys are generated.

5. Save both the public and private keys. Optionally, a key passphrase can be entered to protect the private key.

To add the public key to the FortiGate:

1. Delete the Key comment, then copy the public key from the PuTTY Key Generator.

   Conversely, you can also open the saved public key in Notepad, remove the line breaks from the key, then remove extraneous lines:

   ---- BEGIN SSH2 PUBLIC KEY ----
   Comment: "rsa-key-2022XXXX"

   ---- END SSH2 PUBLIC KEY ----

2. Add the key to the FortiGate:

   config system admin
       edit <admin>
           set ssh-public-key1 "<key_type> <key_value>"
       next
   end

   Where <key_value> is the copied key, and <key_type> depends on the type of key that was generated:

   RSA	ssh-rsa
   ECDSA	ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521
   EdDSA	ssh-ed25519

To add the private key to the endpoint:

1. Open PuTTY Pageant.

2. Click Add Key or Add Key (encrypted) and select the previously saved private key.

3. Click Close.

You can now log in to the FortiGate on an SSH connection without using a password.

If using PuTTY, the username can be entered under Connection > Data in the Auto-login username field.

The generated keys can also be used in a certificate to authenticate with the FortiGate. See Administrative access using certificates for information about generating and using certificates for administrative authentication.