system admin
Use this command to configure FortiMail administrator accounts.
admin and remote_wildcard. remote_wildcard account
If you need role-based access control (RBAC), you can restrict each administrator account to specific protected domains and/or with restricted permissions.
Depending on the type of your FortiMail administrator account, the list of administrators may not display all administrator accounts. See details about FortiMail administrator permissions.
Syntax
config system admin
edit "<name_str>"
set trusted-hosts <host_ipv4mask>
set level {domain | domain-group | system}
set domain <protected-domain_name>
set domain-group <protected-domain-group_name>
set access-profile <profile_name>
set webmode {advanced | cloud-api | simple}
set theme {Blue | Green | Light-Blue | Neutrino | Red}
set auth-strategy {ldap | local | pki | radius | sso}
[set old-password <password_str>]
set tfa-status {enable | disable}
set tfa-type {fortiidentity-cloud}
set fic-activation-notification-method {email | sms}
set fic-token-delivery-method {app | email | sms}
set tfa-email-address <administrator_email>
set tfa-phone-number <sms_str>
set ldap-profile <profile_name>
set radius-profile <profile_name>
set sso-profile <profile_name>
set sshkey <key_str>
end
|
Variable |
Description |
Default |
||
|
Enter the name of the administrator account. The name can contain numbers (0-9), uppercase and lowercase letters (A-Z, a-z), hyphens ( - ), and underscores ( _ ). Other special characters and spaces are not allowed. Names in administrator login dialogs are case-insensitive.
|
|
|||
|
Select which administrator access profile to use. See details about FortiMail administrator permissions.
|
|
|||
|
Select which FortiMail access methods that this account is allowed to use:
Also select which network interfaces can receive these types of connections. See allowaccess {ping http https snmp ssh telnet}.
|
|
|||
|
Select which type of local or remote authentication the administrator will use:
If you select a remote authentication type, then also select which settings to use to query the authentication server, such as
|
local |
|||
|
Select which group of protected domains the administrator is assigned to. This setting is available only if
|
|
|||
|
Select which protected domains the administrator is assigned to. This setting is available only if
|
|
|||
|
Select which method to use when sending the MFA account invitation, either:
|
|
|||
|
Select how the administrator will get MFA token codes, either:
This setting is used only if |
app |
|||
|
Select which language to use for the display language of the GUI. To view a list of languages, enter a question mark ( Optionally, you can also configure |
english |
|||
|
Select which LDAP profile to use. This setting is available only if |
|
|||
|
Select the administrator's domain scope, either:
|
system |
|||
|
If you are testing a new firmware version, then you may need to downgrade if the test is not successful. This setting temporarily stores the password for the account in an older encryption format for backwards compatibility. It is automatically removed during the next upgrade. Alternatively, to strengthen security, manually remove this setting once firmware testing is complete. For example, a line in a configuration backup file may show an old password that was previously encrypted with SHA-256: set old-password ENC SH2...=
|
|
|||
|
Enter the new password for the administrator account. The password can contain any character except spaces. New passwords cannot be the same as the old one. More criteria may be configured in If you are changing another administrator's password, you are prompted enter the existing password first. Only the account named After you save the password, at rest, FortiMail stores the password in an encrypted format. For example, a line in a configuration backup file may show that a password has been encrypted with PBKDF2: set password ENC PB2...= Then FortiMail automatically logs out all of the administrator's existing GUI, CLI, and REST API sessions so that the new password takes effect immediately. This setting is available only if |
|
|||
|
Select which PKI user profile to use. Also configure This setting is available only if |
|
|||
|
Select which RADIUS profile to use. Also configure This setting is available only if |
|
|||
|
Enter the SSH public key string surrounded in single straight quotes ( When connecting from an SSH client that presents this key, the administrator will not need to provide their account name and password to log in to the CLI. |
|
|||
|
Select which SSO profile to use. This setting is available only if |
|
|||
|
Enable or disable the administrator account. If disabled, the account cannot log into FortiMail. |
disable |
|||
|
Enter the administrator's email address. This setting is used only if |
|
|||
|
Enter the administrator's mobile device number. The number must start with This setting is used only if |
|
|||
|
Enable to use one-time password (OTP) token codes in addition to a password for multi-factor authentication (MFA) when authenticating this account. Also configure Upon saving an account with this setting enabled, FortiMail automatically synchronizes the list of accounts in FortiIdentity Cloud, where you can provision tokens for them. However if needed, you can also manually trigger a synchronization. See sync. FortiIdentity Cloud automatically sends an enrollment invitation for newly synchronized accounts. If needed, you can use the CLI to manually resend the MFA invitation. See activation <administrator_name>. When an administrator logs in, FortiMail validates the username and password like usual, and then if successful, sends an authentication request to the MFA provider, which provides a token code to the administrator. The administrator has up to 2 minutes to either:
Token expiry times configured in FortiIdentity Cloud do not effect this time limit. This setting is available only if:
|
disable |
|||
|
Select the type of MFA. Currently, only FortiIdentity Cloud is supported. This setting is used only if |
fortiidentity-cloud |
|||
|
Select which color theme to use for the GUI. Optionally, you can also configure |
Green |
|||
|
Enter an IPv4 or IPv6 address or subnet from which this administrator can log into FortiMail. Separate multiple IP address and netmask pairs with a comma ( To allow the administrator to authenticate from any IP address, use An IPv4 address and netmask must be in dotted decimal format. For example, you might permit the administrator to log in to the FortiMail system only from your management network by typing
|
0.0.0.0/0.0.0.0 |
|||
|
Select which display mode the GUI will initially use when the administrator logs in. The administrator can switch the display mode during their session; this setting only affects the initial state of the display. This setting is available only if |
simple |
Related topics
fortiidentity-cloud (diagnose command)
fortiidentity-cloud (exec command)