A new restricted admin profile can be used to only change the administrators passwords 7.4.2

This information is also available in the FortiManager 7.4 Administration Guide: Administrator profiles

A new restricted admin profile can be used to only change the administrators passwords.

• A new admin profile called Password_Change_User has been added.

  

• The admin profile has all permissions in the FortiManager GUI set to None.

  

• The admin profile has the following permissions in the CLI:
  • write-passwd-access: Read/Write.
  • rpc-permit: Read/Write.

    

• When the admin profile is applied to a user, the user will see "No access privilege" when attempting to log into the FortiManager GUI.

  

• The user can only access FortiManager using the CLI or API. When logging in via CLI or API, the admin is able to change user's passwords.

  

To specify which user/profile passwords can be changed:

1. In the FortiManager CLI, enter the following commands to configure write-passwd-access:

   config system admin profile

   edit Password_Change_User

   set write-passwd-access

   all All users.

   specify-by-profile Specify by profile.

   specify-by-user Specify by user.

   set write-passwd-access

   There are 3 options, by default allow to change all user's password.

   • all: Password_Change_User admins can change the password for all users.
   • specify-by-profile: Only allow the password of users who are using these profiles to be changed.
     

     set write-passwd-access specify-by-profile

     set write-passwd-profiles

     profileid Profile ID.

     Restricted_User profile

     Standard_User profile

     Super_User profile

     Package_User profile

     No_Permission_User profile

     Password_Change_User profile

     profile1 profile

     set write-passwd-profiles Restricted_User Standard_User profile1

     In this example, Restricted_User, Standard_User, and profile1 are selected. Password_Change_User admins can only change the password of users who are using the Restricted_User, Standard_User, or profile1 profile. The user can't change password of users who are using the Super_User profile for instance.

   • specify-by-user: Only allow the password of users in the list to be changed.
     

     set write-passwd-access specify-by-user

     set write-passwd-user-list

     <userid> users

     admin

     test

     test1

     test2

     test3

     set write-passwd-user-list test test3

     In this example, test and test3 are selected. Password_Change_User admins can only change the password of the test and test3 user. Users cannot change the password of admin, test1, or test2.