config ssh-filter profile

Configure SSH filter profile.

config ssh-filter profile
    Description: Configure SSH filter profile.
    edit <name>
        set block {option1}, {option2}, ...
        set default-command-log [enable|disable]
        set fabric-force-sync [enable|disable]
        set fabric-object [enable|disable]
        set fabric-object-source [member|local|...]
        set log {option1}, {option2}, ...
        config shell-commands
            Description: SSH command filter.
            edit <id>
                set action [block|allow]
                set alert [enable|disable]
                set log [enable|disable]
                set pattern {string}
                set severity [low|medium|...]
                set type [simple|regex]
            next
        end
        set uuid {uuid}
    next
end

config ssh-filter profile

Parameter

Description

Type

Size

Default

block

SSH blocking options.

option

Option	Description
x11	X server forwarding.
shell	SSH shell.
exec	SSH execution.
port-forward	Port forwarding.
tun-forward	Tunnel forwarding.
sftp	SFTP.
scp	SCP.
unknown	Unknown channel.

default-command-log

Enable/disable logging unmatched shell commands.

option

disable

Option	Description
enable	Enable log unmatched shell commands.
disable	Disable log unmatched shell commands.

fabric-force-sync *

Enable/disable forced synchronization of configuration objects from the root FortiGate unit to the downstream devices. Configuration conflict check is skipped.

option

disable

Option	Description
enable	Enable forced synchronization of configuration objects from the root FortiGate unit to the downstream devices.
disable	Disable forced synchronization of configuration objects from the root FortiGate unit to the downstream devices.

fabric-object *

Security Fabric global object setting.

option

disable

Option	Description
enable	Object is set as a security fabric-wide global object.
disable	Object is local to this security fabric member.

fabric-object-source *

Source of truth for fabric object.

option

root

Option	Description
member	Source of truth for this object is a non-root member of fabric.
local	Source of truth for this object is this security fabric member.
root	Source of truth for this object is the root of the fabric.

log

SSH logging options.

option

Option	Description
x11	X server forwarding.
shell	SSH shell.
exec	SSH execution.
port-forward	Port forwarding.
tun-forward	Tunnel forwarding.
sftp	SFTP.
scp	SCP.
unknown	Unknown channel.

name

SSH filter profile name.

string

Maximum length: 47

uuid *

Universally Unique Identifier (UUID; automatically assigned but can be manually reset).

uuid

Not Specified

00000000-0000-0000-0000-000000000000

* This parameter may not exist in some models.

config shell-commands

Parameter

Description

Type

Size

Default

action

Action to take for SSH shell command matches.

option

block

Option	Description
block	Block the SSH shell command.
allow	Allow the SSH shell command.

alert

Enable/disable alert.

option

disable

Option	Description
enable	Enable alert.
disable	Disable alert.

Id.

integer

Minimum value: 0 Maximum value: 4294967295

log

Enable/disable logging.

option

disable

Option	Description
enable	Enable logging.
disable	Disable logging.

pattern

SSH shell command pattern.

string

Maximum length: 128

severity

Log severity.

option

medium

Option	Description
low	Severity low.
medium	Severity medium.
high	Severity high.
critical	Severity critical.

type

Matching type.

option

simple

Option	Description
simple	Match single command.
regex	Match command line using regular expression.

config ssh-filter profile

Configure SSH filter profile.

config ssh-filter profile
    Description: Configure SSH filter profile.
    edit <name>
        set block {option1}, {option2}, ...
        set default-command-log [enable|disable]
        set fabric-force-sync [enable|disable]
        set fabric-object [enable|disable]
        set fabric-object-source [member|local|...]
        set log {option1}, {option2}, ...
        config shell-commands
            Description: SSH command filter.
            edit <id>
                set action [block|allow]
                set alert [enable|disable]
                set log [enable|disable]
                set pattern {string}
                set severity [low|medium|...]
                set type [simple|regex]
            next
        end
        set uuid {uuid}
    next
end

config ssh-filter profile

Parameter

Description

Type

Size

Default

block

SSH blocking options.

option

Option	Description
x11	X server forwarding.
shell	SSH shell.
exec	SSH execution.
port-forward	Port forwarding.
tun-forward	Tunnel forwarding.
sftp	SFTP.
scp	SCP.
unknown	Unknown channel.

default-command-log

Enable/disable logging unmatched shell commands.

option

disable

Option	Description
enable	Enable log unmatched shell commands.
disable	Disable log unmatched shell commands.

fabric-force-sync *

Enable/disable forced synchronization of configuration objects from the root FortiGate unit to the downstream devices. Configuration conflict check is skipped.

option

disable

Option	Description
enable	Enable forced synchronization of configuration objects from the root FortiGate unit to the downstream devices.
disable	Disable forced synchronization of configuration objects from the root FortiGate unit to the downstream devices.

fabric-object *

Security Fabric global object setting.

option

disable

Option	Description
enable	Object is set as a security fabric-wide global object.
disable	Object is local to this security fabric member.

fabric-object-source *

Source of truth for fabric object.

option

root

Option	Description
member	Source of truth for this object is a non-root member of fabric.
local	Source of truth for this object is this security fabric member.
root	Source of truth for this object is the root of the fabric.

log

SSH logging options.

option

Option	Description
x11	X server forwarding.
shell	SSH shell.
exec	SSH execution.
port-forward	Port forwarding.
tun-forward	Tunnel forwarding.
sftp	SFTP.
scp	SCP.
unknown	Unknown channel.

name

SSH filter profile name.

string

Maximum length: 47

uuid *

Universally Unique Identifier (UUID; automatically assigned but can be manually reset).

uuid

Not Specified

00000000-0000-0000-0000-000000000000

* This parameter may not exist in some models.

config shell-commands

Parameter

Description

Type

Size

Default

action

Action to take for SSH shell command matches.

option

block

Option	Description
block	Block the SSH shell command.
allow	Allow the SSH shell command.

alert

Enable/disable alert.

option

disable

Option	Description
enable	Enable alert.
disable	Disable alert.

Id.

integer

Minimum value: 0 Maximum value: 4294967295

log

Enable/disable logging.

option

disable

Option	Description
enable	Enable logging.
disable	Disable logging.

pattern

SSH shell command pattern.

string

Maximum length: 128

severity

Log severity.

option

medium

Option	Description
low	Severity low.
medium	Severity medium.
high	Severity high.
critical	Severity critical.

type

Matching type.

option

simple

Option	Description
simple	Match single command.
regex	Match command line using regular expression.

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

Web Application / API Protection

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

All Products

CLI Reference

config ssh-filter profile

config ssh-filter profile

config ssh-filter profile

config shell-commands

config ssh-filter profile

config ssh-filter profile

config ssh-filter profile

config shell-commands