Remove default admin user and create one with other name

심각레벨 1자동fortigate

설명

Before deploying any new FortiGate, it is important to change the password of the default admin account. It is also recommended that you change even the user name of the default admin account, However, since you cannot change the user name of an account that is currently in use, a second administrator account must be created in order to do this. FAILs if the default 'admin' account still exists. Logging in as admin with a blank password (the CIS audit) is also worth trying. Audited against FortiOS 'show full-configuration' output (run it from the global context on VDOM-enabled units and save the full output); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

점검 방법

감사 방식: 구성 패턴

패턴: (?m)^config system admin\n(?:[ \t]+[^\n]*\n)*?[ \t]+edit "admin"[ \t]*$

조치 방법

조치 방식: 가이드 또는 인프라 패치

config system admin edit "mycompanyadmin" set accprofile "super_admin" set password <password> next end (log in as mycompanyadmin, then) config system admin delete "admin" end # CIS guidance: First create an other local admin account, for example mycompanyadmin. #if VDOM enabled config global #configure new admin config system admin edit "mycompanyadmin" set password set accprofile "super_admin" next end Verify if the newly created login works by opening another CLI session, do not logout of your current session. Once validated, logout with the default local admin account and use the CLI session with mycompanyadmin to delete the default local admin account. Please make sure there are no references in the configuration to the account (groups, etc.) #if VDOM enabled config global config system admin delete "admin" end To change the default password in the GUI: Global (if VDOM enabled) > System > Administrators Create New admin account (mycompanyadmin) Verify if you can login with that account via another browser session (eg. incognito mode). Remove default admin System > Administrators menu

속성

운영 체제: 모두
태그: fortigateauthentication
참고 자료: CIS FortiGate 7.4.x Benchmark v1.0.1 - 2.4.1 Remove default admin user and create one with other name

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target fortigate