Separating the SSHD host key from the administration server certificate

Separating the SSHD host key from the administration server certificate addresses the issue where the administration server key tends to overwrite one of the key files, which can lead to complications. This resolves the problem where the SSH module regenerates the host key files after a factory reset. This action previously prompted a warning message when an older SSH client attempted to log in to the FortiGate using SSH.

config system global
    set ssh-hostkey-override {enable | disable}
    set ssh-hostkey-password <password>
    set ssh-hostkey <encrypted_private_key>
end

The ssh-hostkey-algo option under config system global supports ECDSA 384 and ECDSA 256, allowing the SSHD to accommodate the most commonly used host key algorithms.

To configure SSH host key override in SSHD:

1. Using the ssh-keygen tool, generate the host key (ecdsa-sha2-nistp384 is used in this example).

2. Configure the SSH host key override settings:

   config system global
       set ssh-hostkey-override enable
       set ssh-hostkey-algo ecdsa-sha2-nistp384
       set ssh-hostkey-password **********
       set ssh-hostkey <encrypted_private_key>
   end

3. On a PC, attempt to log in to the FortiGate with the defined ecdsa-sha2-nistp384 algorithm:

   root@PC05:~# ssh admin@172.16.200.1
   The authenticity of host '172.16.200.1 (172.16.200.1)' can't be established.
   ECDSA key fingerprint is SHA256:mcrMXSjtN/YjY3zQgZpxk77ezxPVGGGOL/GUOG8Oijs.
   Are you sure you want to continue connecting (yes/no)? yes
   Warning: Permanently added '172.16.200.1' (ECDSA) to the list of known hosts.

4. Verify the server host key algorithms:

   root@PC05:~# nmap -sV --script ssh2-enum-algos 172.16.200.1
   Starting Nmap 7.01 ( https://nmap.org ) at 2023-11-07 15:47 PST
   Nmap scan report for FGT_A (172.16.200.1)
   Host is up (0.00013s latency).
   Not shown: 995 filtered ports
   PORT    STATE  SERVICE      VERSION
   22/tcp  open   ssh          (protocol 2.0)
   | ssh2-enum-algos:
   |   kex_algorithms: (8)
   |       diffie-hellman-group14-sha256
   |       diffie-hellman-group16-sha512
   |       diffie-hellman-group18-sha512
   |       diffie-hellman-group-exchange-sha256
   |       curve25519-sha256@libssh.org
   |       ecdh-sha2-nistp256
   |       ecdh-sha2-nistp384
   |       ecdh-sha2-nistp521
   |   server_host_key_algorithms: (1)
   |       ecdsa-sha2-nistp384
   |   encryption_algorithms: (3)