Is it possible to disable "shutdown" in Fortigate?

Hi @jefazo92 ,

As far as I know, Fortigate does not allow restricting a specific command. However, you can turn off the use of the execute command for a specific admin profile. The user will not be able to run any command that starts with the execute command.

https://docs.fortinet.com/document/fortigate/7.4.0/new-features/98190/cli-system-permissions-7-4-2

I could not test this, but if you give the user the prof_admin role, he can be prevented from turning off the device. But as I said, I haven't tried it before, you need to try it.

As an alternative, if you remove the configuration and maintenance privileges in the admin profile, the shutdown command will not work.

It is not possible to restrict the execution of a particular command in Fortigate. However, you can handle this using the below settings 

1. Give read-only permission in the maintenance section of the admin profile 

system-admin profiles-->select profile--customize permission in the system

This will disable the shutdown from GUI

2. Disable the execution commands-- Will disable the shutdown from CLI

config system accprofile

edit <name>

set cli-exec disable

end

I feel it should be mentioned that while disabling the "exec" command in the admin profile will solve the problem, it will block a lot of 'innocent' commands as well. Like ping, ping-options, traceroute. Whether an admin could live with that, or should just respect the rule not to ever shutdown the firewall, is debatable.

I mean, there is a security prompt in this command, both in GUI and CLI, before it is executed, for a good reason.

Thanks for raising your concern regarding the exec command.
As mentioned in my last post, It is impossible to restrict the execution of a particular command in Fortigate so disabling the exec functionally will disable all executable commands. 

hi,

yes, you can setup access profile for read/write in order to disable a reboot or shutdown of the FG.

see sample photo below where we've disabled access to "system"