LDAP Admin Login to FGT - Change Default Password Request

Hi,

I thought it's obvious from the message and your logon, but  ... 

It happens simply because you are using default admin with default "blank" password which is really not a great idea for the firewall.

Anybody who can find out IP/FQDN of your firewall and can access through the port (allowaccess, trusted hosts) is then able to login as Admin and change whatever he/she wants.

As Fortinet decided that this is really bad practice to leave the super admin account unprotected, then that's why you get warning/reminder each logon you do without password set.

Best regards,

Tomas

Hello,

This is my config:

# get sys status | grep build Version: FortiGate-80D v5.6.3,build1547,171204 (GA)

config user ldap edit "LAB" set server "192.168.221.10" set secondary-server "192.168.222.10" set cnid "sAMAccountName" set dn "ou=lab,dc=lab,dc=gts,dc=cz" set type regular set username "administrator@lab.gts.cz" set password ENC 3gXQSQKut2Tn5dPpXZjx9cMoUJNyNFOuJvgEYwAWvmpIQ6Dlfs1J+IVi1obbsO6LoburGJMcveexLBBqXUB5HdUHr71ldKXxSWR0MEsugzJZQpzFFNVK5hUSENaShXmWyn6sEuxTvpG4Lqo8P+lgfmnUkFYGh9aQdMIcu3W/SujGP4Em2z/RENXttVW6WuOjq28NwQ== set secure ldaps set ca-cert "CA_Cert_3" set port 636 set password-expiry-warning enable set password-renewal enable next end

config user group edit "fwadminsldap" set member "LAB" config match edit 1 set server-name "LAB" set group-name "CN=fwadminsldap,OU=Users,OU=LAB,DC=lab,DC=gts,DC=cz" next end next end

config system admin edit "LDAPadmins" set remote-auth enable set accprofile "super_admin" set vdom "root" set wildcard enable set remote-group "fwadminsldap" next end

I can see that in your admin config the wildcard option is missing. It means that the admin "test" with the password stored in LDAP will be authenticated. This is not our case. (But it not worked for me either - the login was successful but the FGT showed me the login page again.)

The authd and fnband debug shows this:

[2127] handle_req-Rcvd auth req 825730477 for fwadmin in fwadminsldap opt=00014001 prot=10 [355] __compose_group_list_from_req-Group 'fwadminsldap' [605] fnbamd_pop3_start-fwadmin [340] radius_start-Didn't find radius servers (0) [701] auth_tac_plus_start-Didn't find tac_plus servers (0) [871] resolve_ldap_FQDN-Resolved address 192.168.221.10, result 192.168.221.10 [871] resolve_ldap_FQDN-Resolved address 192.168.222.10, result 192.168.222.10 [1147] build_search_base-search base is: ou=lab,dc=lab,dc=gts,dc=cz

[1267] fnbamd_ldap_init-search filter is: sAMAccountName=fwadmin

[492] create_auth_session-Total 1 server(s) to try [263] start_search_dn-base:'ou=lab,dc=lab,dc=gts,dc=cz' filter:sAMAccountName=fwadmin

[1653] fnbamd_ldap_get_result-Going to SEARCH state [2832] auth_ldap_result-Continue pending for req 825730477 [296] get_all_dn-Found DN 1:CN=fwadmin,OU=Users,OU=LAB,DC=lab,DC=gts,DC=cz

[310] get_all_dn-Found 1 DN's [344] start_next_dn_bind-Trying DN 1:CN=fwadmin,OU=Users,OU=LAB,DC=lab,DC=gts,DC=cz [1701] fnbamd_ldap_get_result-Going to USERBIND state [2832] auth_ldap_result-Continue pending for req 825730477 [570] start_user_attrs_lookup-Adding attr 'memberOf' [591] start_user_attrs_lookup-base:'CN=fwadmin,OU=Users,OU=LAB,DC=lab,DC=gts,DC=cz' filter:cn=*

[1757] fnbamd_ldap_get_result-Entering CHKUSERATTRS state [2832] auth_ldap_result-Continue pending for req 825730477 [793] get_member_of_groups-Get the memberOf groups. [828] get_member_of_groups- attr='memberOf', found 1 values [91] ldap_grp_list_add-added CN=fwadminsldap,OU=Users,OU=LAB,DC=lab,DC=gts,DC=cz [837] get_member_of_groups-val[0]='CN=fwadminsldap,OU=Users,OU=LAB,DC=lab,DC=gts,DC=cz' [626] start_primary_group_lookup-starting check... [630] start_primary_group_lookup-number of sub auths 5 [648] start_primary_group_lookup-base:'ou=lab,dc=lab,dc=gts,dc=cz' filter:(&(objectclass=group)(objectSid=\01\05\00\00\00\00\00\05\15\00\00\00\5b\93\7a\51\bb\78\68\5c\bf\c4\1a\88\01\02\00\00))

[1780] fnbamd_ldap_get_result-Entering CHKPRIMARYGRP state [2832] auth_ldap_result-Continue pending for req 825730477 [765] get_primary_groups- [1814] fnbamd_ldap_get_result-Auth accepted [1925] fnbamd_ldap_get_result-Going to DONE state res=0 [146] __ldap_copy_grp_list-copied CN=fwadminsldap,OU=Users,OU=LAB,DC=lab,DC=gts,DC=cz [2738] fnbamd_auth_poll_ldap-Result for ldap svr 192.168.221.10 is SUCCESS [2753] fnbamd_auth_poll_ldap-Passed group matching [943] find_matched_usr_grps-Group 'fwadminsldap' passed group matching [944] find_matched_usr_grps-Add matched group 'fwadminsldap'(12) [182] fnbamd_comm_send_result-Sending result 0 (error 0, nid 0) for req 825730477 [637] destroy_auth_session-delete session 825730477 [53] ldap_grp_list_del_all-Del CN=fwadminsldap,OU=Users,OU=LAB,DC=lab,DC=gts,DC=cz

====== here I tried to change the password - but no success ======= [2530] handle_req-Rcvd 8 req [928] fnbamd_cfg_get_radius_acct_servers-Error finding rad server LAB [365] fnbamd_acct_start_STOP-Error getting radius server [1345] create_acct_session-Error start acct type 8 [2544] handle_req-Error creating acct session 8

------ it seems to me that it tries to change the password via RADIUS server. Probably LDAP is not supported?