Special Notices

This section highlights key operational changes in FortiSOAR release 7.6.5 for administrators to consider.

Root Shell Access Disabled for csadmin

Starting with release 7.6.5, the csadmin user’s sudo privileges are restricted to only the commands required to work with FortiSOAR, instead of providing full 'root' access. This enhancement aligns with the principle of least privilege and reduces exposure to sensitive system files. Therefore, commands such as yum, systemctl, csadm, etc, must be prefixed with sudo, for example, sudo csadm --help.

To open or edit a file, prefix the command with 'sudo' and specify the file’s full path (sudo vi <full path of file>).
For example, sudo vi /opt/cyops-auth/utilities/das.ini

For security reasons, 'root' access is provided via the system console and is not available over SSH.

Enhanced Security Validation for Connector Configuration Updates

Starting with release 7.6.5, changing any connector configuration fields (e.g., Server URL, Hostname, Address, or Server IP) now requires users to re-enter all password-type fields before saving or applying the configuration. This change strengthens security by ensuring that updated host or endpoint details are always paired with reconfirmed credentials, reducing the risk of misconfiguration or unintended access.

User Impact: Prior to this release, password re-entry was not required after updating the connector configuration fields. Users will now encounter an additional validation step, specifically a prompt to re-enter password-type fields before completing the update.
Note: This requirement does not apply to fields that are dynamically populated from the vault.

Enhanced Security for iFrame Content

After upgrading to release 7.6.5 or later, iFrame content may no longer display. Instead, the following message appears: This domain is not added in the 'Allowed Domains list' and cannot be accessed. Please contact your administrator for further assistance.

This behavior occurs because release 7.6.5 introduces enhanced iFrame security controls that affect how external content is embedded in the application. Sandbox restrictions are enabled by default, and all domains are blocked unless explicitly added to the 'Allowed Domains' list. To enable iFrame content from specific external domains, update the 'iFrame Settings'. For details on how to change these settings, see the iFrame Settings topic in the Application Configuration section of the "Administration Guide."