Is it possible to disable "shutdown" in Fortigate?

[jefazo92]

Hi everyone,

I want to prevent anyone from being able to shutdown the Fortigate from GUI or CLI. Is there a command which can allow me to implement this on the Fortigate 100F?

[ozkanaltas]

Hi @jefazo92 ,

As far as I know, Fortigate does not allow restricting a specific command. However, you can turn off the use of the execute command for a specific admin profile. The user will not be able to run any command that starts with the execute command.

https://docs.fortinet.com/document/fortigate/7.4.0/new-features/98190/cli-system-permissions-7-4-2

I could not test this, but if you give the user the prof_admin role, he can be prevented from turning off the device. But as I said, I haven't tried it before, you need to try it.

As an alternative, if you remove the configuration and maintenance privileges in the admin profile, the shutdown command will not work.

[amrit]

It is not possible to restrict the execution of a particular command in Fortigate. However, you can handle this using the below settings 

1. Give read-only permission in the maintenance section of the admin profile 

system-admin profiles-->select profile--customize permission in the system

This will disable the shutdown from GUI

2. Disable the execution commands-- Will disable the shutdown from CLI

config system accprofile

edit <name>

set cli-exec disable

end

[ede_pfau]

I feel it should be mentioned that while disabling the "exec" command in the admin profile will solve the problem, it will block a lot of 'innocent' commands as well. Like ping, ping-options, traceroute. Whether an admin could live with that, or should just respect the rule not to ever shutdown the firewall, is debatable.

I mean, there is a security prompt in this command, both in GUI and CLI, before it is executed, for a good reason.

[amrit]

Thanks for raising your concern regarding the exec command.
As mentioned in my last post, It is impossible to restrict the execution of a particular command in Fortigate so disabling the exec functionally will disable all executable commands. 

[johnlloyd_13]

hi,

yes, you can setup access profile for read/write in order to disable a reboot or shutdown of the FG.

see sample photo below where we've disabled access to "system"