Administrators
 
Administrators
In its factory default configuration, FortiWeb has one administrator account named admin. This administrator has permissions that grant full access to FortiWeb’s features.
To prevent accidental changes to the configuration, it’s best if only network administrators — and if possible, only a single person — use the admin account. You can use the admin administrator account to configure more accounts for other people. Accounts can be made with different scopes of access. If you require such role-based access control (RBAC) restrictions, or if you simply want to harden security or prevent inadvertent changes to other administrators’ areas, you can do so via access profiles. See “Configuring access profiles”. Similarly, you can divide policies and protected host names and assign them to separate administrator accounts. See “Administrative domains (ADOMs)”.
For example, you could create an account for a security auditor who must only be able to view the configuration and logs, but not change them.
Administrators may be able to access the web UI, the CLI, and use ping/traceroute through the network, depending on:
• the account’s trusted hosts (“Trusted hosts”)
• the protocols enabled for each of the FortiWeb appliance’s network interfaces (“Configuring the network interfaces”)
• permissions (see “Permissions”)
To determine which administrators are currently logged in, use the CLI command get system logged-users. For details, see the FortiWeb CLI Reference.
 
To prevent multiple administrators from logging in simultaneously, which could allow them to inadvertently overwrite each other’s changes, enable Enable Single Admin User login. For details, see “Global web UI & CLI settings”.
To configure an administrator account
1. Before configuring the account:
• Configure the access profile that will govern the account’s permissions (see “Configuring access profiles”).
• If ADOMs are enabled, define the ADOM which will be assigned to this account (see “Defining ADOMs”).
• If you already have accounts that are defined on an LDAP (e.g. Microsoft Active Directory or IBM Lotus Domino) or RADIUS server, FortiWeb can query the server in order to authenticate your administrators. Configure the query set (see “Grouping remote authentication queries for administrators”).
2. Go to System > Admin > Administrators.
To access this part of the web UI, your administrator's account access profile must have Read and Write permission to items in the Admin Users category. For details, see “Permissions”.
3. Click Create New.
A dialog appears.
4. Configure these settings:
Setting name
Description
Administrator
Type the name of the administrator account, such as admin1 or admin@example.com, that can be referenced in other parts of the configuration.
Do not use spaces or special characters except the ‘at’ symbol ( @ ). The maximum length is 35 characters.
Note: This is the user name that the administrator must provide when logging in to the CLI or web UI. If using an external authentication server such as RADIUS or Active Directory, this name will be passed to the server via the remote authentication query.
Type
Select either:
• Local User — Authenticate using an account whose name, password, and other settings are stored locally, in the FortiWeb appliance’s configuration.
• Remote User — Authenticate by querying the remote server that stores the account’s name and password. Also configure Admin User Group.
Password
Type a password for the administrator account.
This field is available only when Type is Local User.
Tip: Set a strong password for every administrator account, and change the password regularly. Failure to maintain the password of every administrator account could compromise the security of your FortiWeb appliance. As such, it can constitute a violation of PCI DSS compliance and is against best practices. For improved security, the password should be at least eight characters long, be sufficiently complex, and be changed regularly. To check the strength of your password, you can use a utility such as Microsoft’s password strength meter.
Confirm Password
Re-enter the password to confirm its spelling.
This field is available only when Type is Local User.
Admin User Group
Select a remote authentication query set. See “Grouping remote authentication queries for administrators”.
This field is available only when Type is Remote User.
Caution: Secure your authentication server and, if possible, all query traffic to it. Compromise of the authentication server could allow attackers to gain administrative access to your FortiWeb.
Wildcard
Specifies whether the user-configured access profile in a remote authentication server overrides the access profile that is configured in FortiWeb.
This field is available only when Type is Remote User.
Trusted Host #1
Trusted Host #2
Trusted Host #3
Type the source IP address(es) and netmask from which the administrator is allowed to log in to the FortiWeb appliance. If PING is enabled, this is also a source IP address to which FortiWeb will respond when it receives a ping or traceroute signal.
Trusted areas can be single hosts, subnets, or a mixture. For more information, see “Trusted hosts”.
To allow logins only from one computer, enter its IP address and 32- or 128-bit netmask in all Trusted Host fields:
192.0.2.2/32
2001:0db8:85a3:::8a2e:0370:7334/128
Caution: If you configure trusted hosts, do so for all administrator accounts. Failure to do so means that all accounts are still exposed to the risk of brute force login attacks. This is because if you leave even one administrator account unrestricted (i.e. any of its Trusted Host settings is 0.0.0.0/0.0.0.0), the FortiWeb appliance must allow login attempts on all network interfaces where remote administrative protocols are enabled, and wait until after a login attempt has been received in order to check that user name’s trusted hosts list.
Tip: If you allow login from the Internet, set a longer and more complex Password, and enable only secure administrative access protocols (HTTPS and SSH) to minimize the security risk. For information on administrative access protocols, see “Configuring the network interfaces”. Also restrict trusted hosts to IPs in your administrator’s geographical area.
Tip: For improved security, restrict all trusted host addresses to single IP addresses of computer(s) from which only this administrator will log in.
Access Profile
Select an existing access profile to grant permissions for this administrator account. For more information on permissions, see “Configuring access profiles” and “Permissions”.
You can select prof_admin, a special access profile used by the admin administrator account. However, selecting this access profile will not confer all of the same permissions of the admin administrator. For example, the new administrator would not be able to reset lost administrator passwords.
This option does not appear for the admin administrator account, which by definition always uses the prof_admin access profile.
Tip: Alternatively, if your administrator accounts authenticate via a RADIUS query, you can override this setting and assign their access profile through the RADIUS server using RFC 2548 Microsoft Vendor-specific RADIUS Attributes.
On the RADIUS server, create an attribute named:
ATTRIBUTE Fortinet-Access-Profile 6
then set its value to be the name of the access profile that you want to assign to this account. Finally, in the CLI, enter the command to enable the override:
config system admin
edit "admin1"
set accprofile-override enable
end
If none is assigned on the RADIUS server, or if it does not match the name of an existing access profile on FortiWeb, FortiWeb will fail back to use the one locally assigned by this setting.
Administrative Domain
Select which existing ADOM to assign this administrator account to it, and to restrict its permissions to that ADOM. For more information on ADOMs, see “Administrative domains (ADOMs)” and “Permissions”.
This option appears only if ADOMs are enabled, and if Administrative Domain is not prof_admin. (prof_admin implies global access, with no restriction to an ADOM.)
5. Click OK.
See also
• Configuring access profiles
• Grouping remote authentication queries for administrators
• Configuring the network interfaces
• Trusted hosts
• Permissions
• Administrative domains (ADOMs)