Administrators
In its factory default configuration, FortiWeb has one administrator account named admin with a blank password. This administrator has permissions that grant full access to FortiWeb’s features. When the admin user logs into FortiWeb for the first time or imports a configuration file with a blank password, the user will be forced to change the password. You can log into FortiWeb by the console, the telnet, or SSH to change the password. The admin user can't be deleted.
To prevent accidental changes to the configuration, it’s best if only network administrators—and if possible, only a single person—use the admin account. You can use the admin administrator account to configure more accounts for other people. Accounts can be made with different scopes of access. If you require such role-based access control (RBAC) restrictions, or if you simply want to harden security or prevent inadvertent changes to other administrators’ areas, you can do so via access profiles. See Configuring access profiles. Similarly, you can divide policies and protected host names and assign them to separate administrator accounts. For details, see Administrative domains (ADOMs).
For example, you could create an account for a security auditor who must only be able to view the configuration and logs, but not change them.
Administrators may be able to access the web UI, the CLI, and use ping/traceroute through the network, depending on:
- The account’s trusted hosts. For details, see Trusted hosts.
- The protocols enabled for each of the FortiWeb appliance’s network interfaces. For details, see Configuring the network interfaces.
- Permissions. For details, see Permissions.
To determine which administrators are currently logged in, use the CLI command get system logged-users. For details, see the FortiWeb CLI Reference:
HTTPs://docs.fortinet.com/product/fortiweb/
|
To prevent multiple administrators from logging in simultaneously, which could allow them to inadvertently overwrite each other’s changes, enable How to use the web UI. For details, see Global web UI & CLI settings. |
To configure an administrator account
- Before configuring the account:
- Configure the access profile that will govern the account’s permissions. For details, see Configuring access profiles.
- If ADOMs are enabled, define the ADOM which will be assigned to this account. For details, see Defining ADOMs.
- If you already have accounts that are defined on an LDAP (e.g., Microsoft Active Directory or IBM Lotus Domino) or RADIUS server, FortiWeb can query the server in order to authenticate your administrators. Configure the query set. For details, see Grouping remote authentication queries and certificates for administrators.
To access this part of the web UI, your administrator's account access profile must have Read and Write permission to items in the Admin Users category. For details, see Permissions.
| Administrator |
Type the name of the administrator account, such as The maximum length is 63 characters. Note: This is the user name that the administrator must provide when logging in to the CLI or web UI. If using an external authentication server such as RADIUS or Active Directory, this name will be passed to the server via the remote authentication query. |
| Type |
Select either:
|
| Password |
Type a password for the administrator account. This field is available only when Type is Local User. Tip: Set a strong password for every administrator account, and change the password regularly. Failure to maintain the password of every administrator account could compromise the security of your FortiWeb appliance. As such, it can constitute a violation of PCI DSS compliance and is against best practices. For improved security, the password should be at least eight characters long, be sufficiently complex, and be changed regularly. |
| Confirm Password |
Re-enter the password to confirm its spelling. This field is available only when Type is Local User. |
| Admin User Group |
Select a remote authentication query set. For details, see Grouping remote authentication queries and certificates for administrators. This field is available only when Type is Remote User. Caution: Secure your authentication server and, if possible, all query traffic to it. Compromise of the authentication server could allow attackers to gain administrative access to your FortiWeb. |
| Wildcard |
This is used together with Remote User.
Note: When wildcard is enabled, and if you have defined a group name in the Admin User Group (User > User Group > Admin Group), then the system will match the users in the remote server whose group name value is the same as you defined. This field is available only when Type is Remote User. |
|
Type the source IP address(es) and netmask from which the administrator is allowed to log in to the FortiWeb appliance. If PING is enabled, this is also a source IP address to which FortiWeb will respond when it receives a ping or traceroute signal. Trusted areas can be single hosts, subnets, or a mixture. You can enter up to 10 entries, separating them with space, for example, "192.0.2.2/32 192.0.2.1/25". To allow logins only from one computer, enter its IP address and 32- or 128-bit netmask in all Trusted Host fields:
Caution: If you configure trusted hosts, do so for all administrator accounts. Failure to do so means that all accounts are still exposed to the risk of brute
force login attacks. This is because if you leave even one administrator account unrestricted (i.e. any of its Trusted Host settings is Tip: If you allow login from the Internet, set a longer and more complex Password, and enable only secure administrative access protocols (HTTPS and SSH) to minimize the security risk. For details about administrative access protocols, see Configuring the network interfaces. Also restrict trusted hosts to IPs in your administrator’s geographical area. Tip: For improved security, restrict all trusted host addresses to single IP addresses of computer(s) from which only this administrator will log in. |
|
| Access Profile |
Select an existing access profile to grant permissions for this administrator account. For details about permissions, see Configuring access profiles and Permissions. You can select prof_admin, a special access profile used by the This option does not appear for the Tip: Alternatively, if your administrator accounts authenticate via a RADIUS query, you can override this setting and assign their access profile through the RADIUS server using RFC 2548 (HTTP://www.ietf.org/rfc/rfc2548.txt) Microsoft Vendor-specific RADIUS Attributes. On the RADIUS server, create an attribute named:
then set its value to be the name of the access profile that you want to assign to this account. Finally, in the CLI, enter the command to enable the override: config system admin edit "admin1" set accprofile-override enable end If none is assigned on the RADIUS server, or if it does not match the name of an existing access profile on FortiWeb, FortiWeb will fail back to use the one locally assigned by this setting. |
| Force Password Change | Enable to force the administrator to change the password for next login. This field can be configured only when Password Policy is enabled in System > Admin > Settings. |
| Administrative Domain |
Select which existing ADOM to assign this administrator account to it, and to restrict its permissions to that ADOM. For details about permissions, see Configuring access profiles and Permissions. This option appears only if ADOMs are enabled, and if Administrative Domain is not prof_admin. (prof_admin implies global access, with no restriction to an ADOM.) |