Fortinet white logo
Fortinet white logo

CLI Reference

config system ssh-config

config system ssh-config

Configure SSH config.

config system ssh-config
    Description: Configure SSH config.
    set ssh-kex-algo {option1}, {option2}, ...
    set ssh-enc-algo {option1}, {option2}, ...
    set ssh-mac-algo {option1}, {option2}, ...
    set ssh-hsk-algo {option1}, {option2}, ...
    set ssh-hsk-override [disable|enable]
    set ssh-hsk-password {password}
    set ssh-hsk {user}
end

config system ssh-config

Parameter

Description

Type

Size

Default

ssh-kex-algo

Select one or more SSH kex algorithms.

option

-

diffie-hellman-group14-sha256 diffie-hellman-group16-sha512 diffie-hellman-group18-sha512 diffie-hellman-group-exchange-sha256 curve25519-sha256@libssh.org ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521

Option

Description

diffie-hellman-group1-sha1

diffie-hellman-group1-sha1

diffie-hellman-group14-sha1

diffie-hellman-group14-sha1

diffie-hellman-group14-sha256

diffie-hellman-group14-sha256

diffie-hellman-group16-sha512

diffie-hellman-group16-sha512

diffie-hellman-group18-sha512

diffie-hellman-group18-sha512

diffie-hellman-group-exchange-sha1

diffie-hellman-group-exchange-sha1

diffie-hellman-group-exchange-sha256

diffie-hellman-group-exchange-sha256

curve25519-sha256@libssh.org

curve25519-sha256@libssh.org

ecdh-sha2-nistp256

ecdh-sha2-nistp256

ecdh-sha2-nistp384

ecdh-sha2-nistp384

ecdh-sha2-nistp521

ecdh-sha2-nistp521

ssh-enc-algo

Select one or more SSH ciphers.

option

-

aes256-ctr aes256-gcm@openssh.com

Option

Description

chacha20-poly1305@openssh.com

chacha20-poly1305@openssh.com

aes128-ctr

aes128-ctr

aes192-ctr

aes192-ctr

aes256-ctr

aes256-ctr

arcfour256

arcfour256

arcfour128

arcfour128

aes128-cbc

aes128-cbc

3des-cbc

3des-cbc

blowfish-cbc

blowfish-cbc

cast128-cbc

cast128-cbc

aes192-cbc

aes192-cbc

aes256-cbc

aes256-cbc

arcfour

arcfour

rijndael-cbc@lysator.liu.se

rijndael-cbc@lysator.liu.se

aes128-gcm@openssh.com

aes128-gcm@openssh.com

aes256-gcm@openssh.com

aes256-gcm@openssh.com

ssh-mac-algo

Select one or more SSH MAC algorithms.

option

-

hmac-sha2-256 hmac-sha2-256-etm@openssh.com hmac-sha2-512 hmac-sha2-512-etm@openssh.com

Option

Description

hmac-md5

hmac-md5

hmac-md5-etm@openssh.com

hmac-md5-etm@openssh.com

hmac-md5-96

hmac-md5-96

hmac-md5-96-etm@openssh.com

hmac-md5-96-etm@openssh.com

hmac-sha1

hmac-sha1

hmac-sha1-etm@openssh.com

hmac-sha1-etm@openssh.com

hmac-sha2-256

hmac-sha2-256

hmac-sha2-256-etm@openssh.com

hmac-sha2-256-etm@openssh.com

hmac-sha2-512

hmac-sha2-512

hmac-sha2-512-etm@openssh.com

hmac-sha2-512-etm@openssh.com

hmac-ripemd160

hmac-ripemd160

hmac-ripemd160@openssh.com

hmac-ripemd160@openssh.com

hmac-ripemd160-etm@openssh.com

hmac-ripemd160-etm@openssh.com

umac-64@openssh.com

umac-64@openssh.com

umac-128@openssh.com

umac-128@openssh.com

umac-64-etm@openssh.com

umac-64-etm@openssh.com

umac-128-etm@openssh.com

umac-128-etm@openssh.com

ssh-hsk-algo

Select one or more SSH hostkey algorithms.

option

-

ecdsa-sha2-nistp521 ecdsa-sha2-nistp384 ecdsa-sha2-nistp256 rsa-sha2-256 rsa-sha2-512 ssh-ed25519

Option

Description

ssh-rsa

ssh-rsa

ecdsa-sha2-nistp521

ecdsa-sha2-nistp521

ecdsa-sha2-nistp384

ecdsa-sha2-nistp384

ecdsa-sha2-nistp256

ecdsa-sha2-nistp256

rsa-sha2-256

rsa-sha2-256

rsa-sha2-512

rsa-sha2-512

ssh-ed25519

ssh-ed25519

ssh-hsk-override

Enable/disable SSH host key override in SSH daemon.

option

-

disable

Option

Description

disable

Disable SSH host key override in SSH daemon.

enable

Enable SSH host key override in SSH daemon.

ssh-hsk-password

Password for ssh-hostkey.

password

Not Specified

ssh-hsk

Config SSH host key.

user

Not Specified

config system ssh-config

config system ssh-config

Configure SSH config.

config system ssh-config
    Description: Configure SSH config.
    set ssh-kex-algo {option1}, {option2}, ...
    set ssh-enc-algo {option1}, {option2}, ...
    set ssh-mac-algo {option1}, {option2}, ...
    set ssh-hsk-algo {option1}, {option2}, ...
    set ssh-hsk-override [disable|enable]
    set ssh-hsk-password {password}
    set ssh-hsk {user}
end

config system ssh-config

Parameter

Description

Type

Size

Default

ssh-kex-algo

Select one or more SSH kex algorithms.

option

-

diffie-hellman-group14-sha256 diffie-hellman-group16-sha512 diffie-hellman-group18-sha512 diffie-hellman-group-exchange-sha256 curve25519-sha256@libssh.org ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521

Option

Description

diffie-hellman-group1-sha1

diffie-hellman-group1-sha1

diffie-hellman-group14-sha1

diffie-hellman-group14-sha1

diffie-hellman-group14-sha256

diffie-hellman-group14-sha256

diffie-hellman-group16-sha512

diffie-hellman-group16-sha512

diffie-hellman-group18-sha512

diffie-hellman-group18-sha512

diffie-hellman-group-exchange-sha1

diffie-hellman-group-exchange-sha1

diffie-hellman-group-exchange-sha256

diffie-hellman-group-exchange-sha256

curve25519-sha256@libssh.org

curve25519-sha256@libssh.org

ecdh-sha2-nistp256

ecdh-sha2-nistp256

ecdh-sha2-nistp384

ecdh-sha2-nistp384

ecdh-sha2-nistp521

ecdh-sha2-nistp521

ssh-enc-algo

Select one or more SSH ciphers.

option

-

aes256-ctr aes256-gcm@openssh.com

Option

Description

chacha20-poly1305@openssh.com

chacha20-poly1305@openssh.com

aes128-ctr

aes128-ctr

aes192-ctr

aes192-ctr

aes256-ctr

aes256-ctr

arcfour256

arcfour256

arcfour128

arcfour128

aes128-cbc

aes128-cbc

3des-cbc

3des-cbc

blowfish-cbc

blowfish-cbc

cast128-cbc

cast128-cbc

aes192-cbc

aes192-cbc

aes256-cbc

aes256-cbc

arcfour

arcfour

rijndael-cbc@lysator.liu.se

rijndael-cbc@lysator.liu.se

aes128-gcm@openssh.com

aes128-gcm@openssh.com

aes256-gcm@openssh.com

aes256-gcm@openssh.com

ssh-mac-algo

Select one or more SSH MAC algorithms.

option

-

hmac-sha2-256 hmac-sha2-256-etm@openssh.com hmac-sha2-512 hmac-sha2-512-etm@openssh.com

Option

Description

hmac-md5

hmac-md5

hmac-md5-etm@openssh.com

hmac-md5-etm@openssh.com

hmac-md5-96

hmac-md5-96

hmac-md5-96-etm@openssh.com

hmac-md5-96-etm@openssh.com

hmac-sha1

hmac-sha1

hmac-sha1-etm@openssh.com

hmac-sha1-etm@openssh.com

hmac-sha2-256

hmac-sha2-256

hmac-sha2-256-etm@openssh.com

hmac-sha2-256-etm@openssh.com

hmac-sha2-512

hmac-sha2-512

hmac-sha2-512-etm@openssh.com

hmac-sha2-512-etm@openssh.com

hmac-ripemd160

hmac-ripemd160

hmac-ripemd160@openssh.com

hmac-ripemd160@openssh.com

hmac-ripemd160-etm@openssh.com

hmac-ripemd160-etm@openssh.com

umac-64@openssh.com

umac-64@openssh.com

umac-128@openssh.com

umac-128@openssh.com

umac-64-etm@openssh.com

umac-64-etm@openssh.com

umac-128-etm@openssh.com

umac-128-etm@openssh.com

ssh-hsk-algo

Select one or more SSH hostkey algorithms.

option

-

ecdsa-sha2-nistp521 ecdsa-sha2-nistp384 ecdsa-sha2-nistp256 rsa-sha2-256 rsa-sha2-512 ssh-ed25519

Option

Description

ssh-rsa

ssh-rsa

ecdsa-sha2-nistp521

ecdsa-sha2-nistp521

ecdsa-sha2-nistp384

ecdsa-sha2-nistp384

ecdsa-sha2-nistp256

ecdsa-sha2-nistp256

rsa-sha2-256

rsa-sha2-256

rsa-sha2-512

rsa-sha2-512

ssh-ed25519

ssh-ed25519

ssh-hsk-override

Enable/disable SSH host key override in SSH daemon.

option

-

disable

Option

Description

disable

Disable SSH host key override in SSH daemon.

enable

Enable SSH host key override in SSH daemon.

ssh-hsk-password

Password for ssh-hostkey.

password

Not Specified

ssh-hsk

Config SSH host key.

user

Not Specified