CLI system permissions 7.4.2

Users now have the capability to exercise more granular control over CLI commands. This feature allows administrators to customize access to CLI commands based on their role, access level, or seniority, thereby enhancing both security and efficiency.

To configure CLI command access in administrative profiles:

config system accprofile
    edit <name>
        set cli-diagnose {enable | disable}
        set cli-get {enable | disable}
        set cli-show {enable | disable}
        set cli-exec {enable | disable}
        set cli-config {enable | disable}
    next
end

This command allows the administrator to configure the administrator profiles by enabling specific CLI commands as needed. The default setting for all the CLI command options is disable.

To edit an administrator profile, you must be logged in to an account with sufficient privileges, or as a super_admin user. By default, the FortiGate has an administrator account that uses the super_admin profile. See Administrator profiles for more information.