Administrator access hardening

The disallowed-login-methods configuration setting allows administrators to explicitly block specific access methods for logging into the FortiGate, such as console, GUI, SSH, or Telnet. Specifying the GUI access method will prohibit the ability of the administrator to log into the FortiGate through HTTP and HTTPS.

This feature introduces granular control over login channels, enhancing security by enabling organizations to disable unwanted or less secure access methods.

CLI syntax

The following command can be implemented to block login access through specific methods:

config sys admin
    edit <administrator>
        set disallowed-login-methods {console | gui | ssh | telnet}
    next
end

To enable administrator access hardening:

1. Configure the administrator and block access to SSH login attempts:

   config sys admin
       edit "admin1"
           set disallowed-login-methods ssh
           set accprofile "prof_admin"
           set vdom "root"
           set password ENC xxxxxxxx
       next
   end

2. Enter the current administrator password when prompted.

3. Attempt to log into the FortiGate by SSH as the administrator. The login attempt is blocked.

4. Review the logs:

   # execute log display
   9: date=2025-07-21 time=14:26:59 eventtime=1753133219677192147 tz="-0700" logid="0100032002" type="event" subtype="system" level="alert" vd="root" logdesc="Admin login failed" sn="0" user="admin1" ui="ssh(172.16.200.55)" method="ssh" srcip=172.16.200.55 dstip=172.16.200.1 action="login" status="failed" reason="none" msg="Administrator admin1 login failed from ssh(172.16.200.55)"