GCP: Disable OS Login

[ble]

I am currently provisioning a FortiGate 7.0 VM HA cluster in the Google Cloud (through the GCP image). Now our organizational policy requires OS Login to be enabled. This results in a high number of users managed by the Google IAM to be imported as "prof_admin" into the machine. Is there a possibility to disable the OS login feature on the Fortigate directly so that the GCP does not manage the users on the VM? I realized that I myself am "super_admin". Is that because I am the creator of the VM? In general, who gets the "super_admin" role? Is there some documentation on how the FortiGate VM image integrates into the GCP?

Thanks in advance.

[HarshChavda]

Hello @ble ,

FortiGate VMs in Google Cloud Platform (GCP) are generally managed through the FortiGate web interface or CLI, rather than the OS-level login that you might use for a general-purpose VM. However, GCP's OS Login feature can interfere with this by automatically creating user accounts based on Google IAM roles. Disabling OS Login is generally done at the GCP level, not within the FortiGate VM itself. You would typically disable this feature by modifying the instance metadata or by using an organization policy that disables OS Login. However, since your organizational policy requires OS Login to be enabled, you may need to consult with your cloud or security team to find a solution that meets your organization's requirements. 

You can also refer this document: https://docs.fortinet.com/document/fortigate-public-cloud/7.4.0/gcp-administration-guide/736375/abou... 

[spoojary · Accepted solution]

ortiGate on Google Cloud Platform (GCP) is a little different from traditional FortiGate deployments in that it integrates with GCP's native features, like OS Login.

Here's a breakdown of your concerns:

1. OS Login Integration: The integration of FortiGate VM with Google Cloud's OS Login feature is likely to facilitate user management by aligning with GCP's security practices. As of  there's no direct method on the FortiGate VM to disable OS Login once it's enabled at the GCP level. However, it's crucial to note that OS Login is a GCP-level feature and its behavior is controlled from the GCP console, not the FortiGate itself.

2. Super Admin: Yes, typically, the creator of the VM or the deployment will have the "super_admin" role. This role has the highest set of privileges on the FortiGate. The assignment of the "super_admin" role is usually based on the context of deployment and the user who initiates the deployment.

3. Documentation: Fortinet's documentation is quite extensive. You'd want to check the Fortinet Documentation Library for specifics on how FortiGate VM integrates with GCP. The guide should provide insights into role assignments, integrations, and other VM-specific behaviors.

   Fortinet Documentation Library

   Remember that cloud documentation can change based on versions and feature updates, so always refer to the documentation associated with your specific FortiOS version and the FortiGate VM version for GCP.

If OS Login does not align with your organization's policies, or if you find it introduces unnecessary complexity, it's crucial to liaise with your security team and Fortinet support. They can provide guidance tailored to your deployment, version, and specific security requirements.

Lastly, always consider testing any changes or configurations in a non-production environment to ensure there are no unintended consequences, especially when working in a cloud environment where certain features might have dependencies or integrations that aren't immediately obvious.

[ble]

Thanks a lot for your replies. I am well aware that requesting an exception from our cloud security team and disabling OS Login at the GCP level is the proper solution to our problem, but sometimes a technical solution is the faster one.

Just as a general feedback: I searched the GCP Administration Guide and did not find anything on OS Login specifically. As you noticed, some dependencies and integrations are not immediately obvious. Therefore, it might be worth the effort from Fortinet's side to document the customizations that have been made to the VM image for GCP integration in particular.