Ensure admin accounts with different privileges have their correct profiles assigned

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

Run 'show full-configuration system accprofile' and review each admin profile: privileges must match the role, with custom sub-permissions checked. Then 'show full-configuration system admin' and confirm every administrator's accprofile matches their role (least privilege).

修复方式

修复方法: 操作指南或基础设施补丁

In this example, the goal is to provide the profile "tier_1" the ability to view and modify address objects. This sub-privilege is under fwgrp privilege. In CLI: config system accprofile edit "tier_1" set fwgrp custom config fwgrp-permission set address read-write end end For the GUI, go to: 1. System > Admin Profiles, select "tier_1" and click "Edit". 2. On "Firewall", click on "Custom". 3. Click on "Read/Write" option for "Address". In the next example, assign the profile "tier_1" to the account "support1". In the CLI: config system admin edit "support1" set accprofile "tier_1" end For the GUI, go to: 1. System > Administrators. 2. Select "support1" and click "Edit". 3. Under "Administrator Profile", select "tier_1".