Detections
Analytics
Fortigate - Password policy enforces lockout upon weaker encryption detection
Information
FortiOS v7.2.11+, v7.4.8+, and v7.6.1+ support the 'login-lockout-upon-weaker-encryption' setting (called 'login-lockout-upon-downgrade' on some v7.2.x and v7.4.x releases) in the system password-policy configuration. When enabled, this setting causes FortiOS to remove residual SHA256 'old-password' entries from the configuration and lock out any administrator whose stored credentials are found to use a weaker hash algorithm than PBKDF2. This prevents a firmware downgrade or configuration manipulation from silently reverting credential storage to a weaker algorithm.Enabling this setting enforces cryptographic hygiene across administrator accounts and ensures that the security gain from PBKDF2 adoption cannot be silently undermined.
Solution
Enable login lockout upon weaker encryption in the password policy:config system password-policy
set login-lockout-upon-weaker-encryption enable
end
Note: On certain v7.2.x and v7.4.x builds the equivalent setting name is 'login-lockout-upon-downgrade'. Verify the correct setting name for the installed FortiOS version. After enabling this setting, performing a firmware downgrade will lock out all administrators; ensure a recovery plan is in place before enabling in production environments.
See Also
Item Details
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5(1)
Plugin: FortiGate
Control ID: a2f73619e6a0d3c2d59ab27ae19aa5b21931d02efa4d861791356fa4074cd4ca