FortiSOAR root account

Hi!

It is correct that you’re not able to do it. It is a standard setting of the underlying FortiSOAR OS.

I don’t know which version you’re running, however I took the docs for 8.0 as a reference.

It remarks the following:
Users running sudo commands as the ‘csadmin’ user will be prompted for a password on all systems except AWS.
After deploying FortiSOAR 7.6.5 or later, the csadmin user’s sudo privileges are restricted to only the commands required to work with FortiSOAR, instead of providing full 'root' access. This enhancement aligns with the principle of least privilege and reduces exposure to sensitive system files. Therefore, commands such as yum, systemctl, csadm, etc, must be prefixed with sudo, for example, sudo csadm --help. To open or edit a file, prefix the command with 'sudo' and specify the file’s full path (sudo vi <full path of file>)
The configuration wizard allows you to reset the root user password as its first step. If the root password reset step is missed, the password must be reset later from the VM console. Refer to the Red Hat or Rocky Linux documentation for instructions on resetting the root password.
Note: After login, the 'csadm' user is assigned limited sudo privileges. For security reasons, 'root' access is provided via the system console and is not available over SSH.

So long answer short, taking best practices into account, if you need to have direct root access, you need to use the console.

If this is not possible within your organization, be careful with adding broader sudo rights to your csadmin.

If it is absolutely crucial that you that you can use unrestricted sudo over SSH, consider the following:

• Don’t expose root to SSH
• Create a new sudo priveleged user on the OS
• Limit the users access over SSH to limited trusted IP’s

The document below also proves some guidance on how to create an additional user, a so called backup user.

This could be more then one and can have a different name.

https://docs.fortinet.com/document/fortisoar/8.0.0/deployment-guide/158469/standard-deployment-setup

Just carefully consider the risks and rewards. Ensure what you’re doing while using elevating privileges.

And consider, when in doubt if it supported or running into issues, open a ticket with Fortinet Support through your support account.

Have a nice day!

Unfortunately you will need to have access to the root account indeed to execute both to update the trust store and the create the additional account.

By default root is only accessible by directly accessing the VM’s console, not through SSH or su.

If you can’t access the root account due to a missing root password, you would have to reset the root account’s password.

Please consider the following article:
 

You can reset the root through the same procedure.

Please ensure you have proper backups in place just to be safe.

And remember, when in doubt, you can always contact Fortinet Support!