config system admin
Use this command to manage administrator and REST API administrator accounts.
Administrator user accounts can be created and configured through the CLI. For details, see Administrator accounts.
REST API administrator accounts can only be edited through the CLI but not created. You can only create a REST API administrator account through the GUI. However, once the account is created in the GUI, the REST API administrator can be edited in the CLI. For details, see REST API administrator accounts.
Administrator accounts
Use config system admin to create and manage administrator accounts.
We recommend that only network administrators—and if possible, only a single person—use the admin account. You can configure accounts that provision different scopes of access. For example, you can create an account for a security auditor who must only be able to view the configuration and logs, but not change them.
Before you begin:
- If you want to use RADIUS, LDAP or TACACS+ authentication, you must have already have created the RADIUS server, LDAP server or TACACS+ server configuration.
- You must have read-write permission for system settings.
Syntax
config system admin
edit <name>
set access-profile <datasource>
set auth-strategy {local|ldap|radius|tacacs_plus}
set ldap-server <datasource>
set radius-server <datasource>
set tacacs-plus-server <datasource>
set is-system-admin {no|yes}
set password <passwd>
set trusted-hosts <ip&netmask>
set vdom <datasource>
set wildcard {disable|enable}
next
end
|
<name> |
Name of the administrator account, such as Do not use spaces or special characters except the ‘at’ symbol ( Note: This is the user name that the administrator must provide when logging in to the CLI or web UI. After you initially save the configuration, you cannot edit the name. |
|
access-profile |
Specify a user-defined or predefined profile. The predefined profile named super_admin_prof is a special access profile used by the admin account. However, specifying this access profile will not confer all permissions of the admin account. For example, the new administrator would not be able to reset lost administrator passwords. Note: This option does not appear for the admin administrator account, which by definition always uses the super_admin_prof access profile. |
|
auth-strategy |
|
|
ldap-server |
If using LDAP, specify the LDAP server configuration. |
|
radius-server |
If using RADIUS, specify the RADIUS server configuration. |
|
tacacs-plus-server |
If using TACACS+, specify the TACACS+ server configuration. |
|
is-system-admin |
Note: The system admin privileges enabled by this setting give the user permission to change any non-global-admin password without its current password and to change any global-admin password with the current password. |
|
password |
Set a strong password for all administrator accounts. The password should be at least eight characters long, be sufficiently complex, and be changed regularly. |
|
wildcard |
Enable/disable user wildcard for remote server authentication. |
|
trusted-hosts |
Source IP address and netmask from which the administrator is allowed to log in. For multiple addresses, separate each entry with a space. You can specify up to three trusted areas. They can be single hosts, subnets, or a mixture. Configuring trusted hosts hardens the security of the system. In addition to knowing the password, an administrator must connect only from the computer or subnets you specify. Trusted host definitions apply both to the web UI and to the CLI when accessed through Telnet, SSH, or the CLI console widget. Local console access is not affected by trusted hosts, as the local console is by definition not remote, and does not occur through the network. If ping is enabled, the address you specify here is also a source IP address to which the system will respond when it receives a ping or traceroute signal. To allow logins only from one computer, enter only its IP address and 32- or 128-bit netmask:
To allow login attempts from any IP address (not recommended), enter:
Caution: If you restrict trusted hosts, do so for all administrator accounts. Failure to do so means that all accounts are still exposed to the risk of brute force login attacks. This is because if you leave even one administrator account unrestricted (i.e. Tip: If you allow login from the Internet, set a longer and more complex New Password, and enable only secure administrative access protocols. We also recommend that you restrict trusted hosts to IPs in your administrator’s geographical area. Tip: For improved security, restrict all trusted host addresses to single IP addresses of computer(s) from which only this administrator will log in. |
|
vdom |
If you have enabled the virtual domain feature, specify the virtual domain that this administrator can view and manage. Note: You can create multiple VDOMs separated by space. |
Example
FortiADC-VM # config system admin
FortiADC-VM (admin) # edit doc-admin
Add new entry 'doc-admin' for node 78
FortiADC-VM (doc-admin) # set access-profile doc-admin
FortiADC-VM (doc-admin) # end
FortiADC-VM # get system admin doc-admin
is-system-admin : no
vdom : root
password : *
trusted-hosts : 0.0.0.0/0 ::/0
auth-strategy : local
access-profile : doc-admin
theme :
role-list :
privilege-map :
access-token : 3p6RgrzT21ciDMdwgowh9Lwd303SoSsrhygy0Or0PDhrnuXBQrRZdnagne 6K6y9o5qU5el31WkqiMmRANIy04IfpWl91SjnXHh0TA1SukjM6DCFoidnmVCKQVRRN8cIP
REST API administrator accounts
Use config system admin to edit the configurable attributes of an existing REST API administrator account.
Before you begin:
- You must have read-write permission for system settings.
- Created a REST API administrator account in the GUI.
|
Although users can use an API request to create a REST API administrator account, the resulting token would not be properly assigned to the user. Without an assigned user this authorization token would be invalid and would not be able to access the supported FortiADC REST APIs. |
Syntax
config system admin
edit <name>
set is-system-admin {no|yes}
set trusted-hosts <ip&netmask>
set access-profile <datasource>
set comments <string>
set cors-allow-origin <string>
next
end
|
<name> |
Enter the login name of the REST API administrator account. |
|
is-system-admin |
Select either of the following global admin access options:
|
|
trusted-hosts |
If restricted to trusted hosts is enabled, specify the trusted host IP address and netmask allowed to log in to the REST API. For multiple addresses, separate each entry with a space. You can specify up to three trusted areas. They can be single hosts, subnets, or a mixture. |
|
access-profile |
The access-profile option is configurable if is-system-admin is no. Specify a user-defined or predefined profile. The predefined profile named super_admin_prof is a special access profile used by the admin account. However, specifying this access profile will not confer all permissions of the admin account. For example, the new administrator would not be able to reset lost administrator passwords. Note: This option does not appear for the admin administrator account, which by definition always uses the super_admin_prof access profile. |
|
comments |
(Optional) Enter comments about the administrator account. |
|
cors-allow-origin |
If CORS Allow Origin is enabled, then specify the URL that can access the REST API. |
Example
config system admin
edit "restapi_admin"
set is-system-admin no
set trusted-hosts 0.0.0.0/0 ::/0
set access-profile super_admin_prof
set comments test
set cors-allow-origin https://fndn.fortinet.net
next
end