Detections
Analytics
Fortigate - Administrator accounts use PBKDF2 password hashing
Information
Starting with FortiOS v7.2.11, v7.4.8, and v7.6.1, FortiGate migrated administrator password storage from SHA256 to PBKDF2 (Password-Based Key Derivation Function 2). PBKDF2 is significantly more resistant to brute-force and offline dictionary attacks than SHA256 because it applies a computationally expensive key-stretching algorithm with a configurable iteration count and salt. Passwords are migrated to PBKDF2 automatically upon a successful administrator login on an eligible firmware version. Accounts that have never logged in after upgrading will retain the older SHA256 hash (prefix 'SH2') until manually re-credentialed.This check verifies that all 'set password' entries in the system admin configuration use the PBKDF2 hash prefix ('PB2'), confirming that accounts have been upgraded to the stronger hash function.
Solution
Ensure the device is running FortiOS v7.2.11+, v7.4.8+, or v7.6.1+ and that all administrator accounts have logged in at least once since the upgrade. To force migration for accounts that have not yet logged in, a super_admin account can reset the password:config system admin
edit <admin_username>
set password <new_password>
next
end
After updating, verify each account's stored password hash begins with 'PB2' when viewing the raw configuration.
See Also
Item Details
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5(1)
Plugin: FortiGate
Control ID: da8dfca4ea905cf940f7954f19b36d1f683e80d8a46b7a348606947916ac505b