Encryption algorithm settings
FortiPAM supports configurable encryption levels to secure log data and SSH communications.
Use the set ssh-algorithm command to define the encryption strength and compatibility level.
Command syntax
set ssh-algorithm {compatible | high-encryption}
|
Command |
Description |
|---|---|
|
set ssh-algorithm compatible |
Allow a broad set of encryption algorithms for best compatibility. |
|
set ssh-algorithm high-encryption |
Allow only AES-CTR, AES-GCM ciphers and high encryption algorithms. |
Supported algorithm sets
Key Exchange (KEX) algorithms
Strong set:
-
curve25519-sha256
-
curve25519-sha256@libssh.org
-
ecdh-sha2-nistp256
-
ecdh-sha2-nistp384
-
ecdh-sha2-nistp521
-
diffie-hellman-group-exchange-sha256
-
diffie-hellman-group16-sha512
-
diffie-hellman-group18-sha512
-
diffie-hellman-group14-sha256
Compatible set:
Includes Strong set and the following:
-
diffie-hellman-group14-sha1
-
diffie-hellman-group1-sha1
-
diffie-hellman-group-exchange-sha1
Ciphers
Strong set:
-
aes128-ctr
-
aes192-ctr
-
aes256-ctr
-
aes128-gcm@openssh.com
-
aes256-gcm@openssh.com
Compatible set:
Includes Strong set and the following:
-
aes128-cbc
-
aes192-cbc
-
aes256-cbc
-
arcfour
-
arcfour256
-
arcfour128
-
blowfish-cbc
-
chacha20-poly1305@openssh.com
-
cast128-cbc
-
3des-cbc
-
rijndael-cbc@lysator.liu.se
MAC Algorithms
Strong set:
-
umac-128-etm@openssh.com
-
hmac-sha2-256-etm@openssh.com
-
hmac-sha2-512-etm@openssh.com
-
hmac-sha1-etm@openssh.com
-
umac-128@openssh.com
-
hmac-sha2-256
-
hmac-sha2-512
-
hmac-sha1
Compatible set:
Includes Strong set and the following:
-
umac-64-etm@openssh.com
-
hmac-ripemd160-etm@openssh.com
-
hmac-sha1-96-etm@openssh.com
-
hmac-md5-etm@openssh.com
-
hmac-md5-96-etm@openssh.com
-
umac-64@openssh.com
-
hmac-ripemd160
-
hmac-ripemd160@openssh.com
-
hmac-sha1-96
-
hmac-md5
-
hmac-md5-96