如何通过ssh-key 连接Fortigate

February 24, 2024

不同版本的Fortigate方法不同

产生ssh-key

产生id_rsa和id_rsa.pub

ssh-keygen -t rsa -b 4096 -C "youname@email.com"

产生id_ed25519和id_ed25519.pub

ssh-keygen -t ed25519 -C "yourname@email.com"

pacman -S gcr
systemctl --user enable gcr-ssh-agent.socket

在.bash_profile中加入

SSH_AUTH_SOCK=$XDG_RUNTIME_DIR/gcr/ssh;export SSH_AUTH_SOCK

在.ssh/conf中加入

Host *
    AddKeysToAgent yes

参考：

FortiOS 6.2支持ssh-ed25519，建议使用这种算法

config system admin
    edit "admin"
        set accprofile "super_admin"
        set ssh-public-key1 "ssh-ed25519 xxxxxxxxxx"
    next
end

FortiOS 6.0不支持ssh-ed25519，只支持ssh-rsa

config system admin
    edit "admin"
        set accprofile "super_admin"
        set ssh-public-key1 "ssh-rsa xxxxxxxxxx"
    next
end

现在OpenSSH 不再支持rsa1算法，协商算法会失败，必须

ssh -i .ssh/id_rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa -o HostKeyAlgorithms=+ssh-rsa <Fortigate IP>

或者在.ssh/conf中加入

Host <Fortigate IP>
    PubkeyAcceptedKeyTypes +ssh-rsa
    HostKeyAlgorithms +ssh-rsa

参考：

FortiGate服务端

diag debug application sshd -1
diag debug enable

ssh客户端

ssh -v -i ./ssh/id_rsa <Fortigate IP>

经测试,现在的新版OpenSSH客户端如不启用ssh-rsa算法，连接set ssh-public-key1 “ssh-rsa xxxxxxxxxx” 的FortiGate会报下面的错

debug1: send_pubkey_test: no mutual signature algorithm

参考