Run backend-shell commands

Sometimes we need to login to FortiWeb backend shell to check logs or collect some specific files. Though we expect all useful logs are collected or archived in the debug log file or can be downloaded from System > Maintenance > Backup & Restore > GUI File Download, some files especially logs for new features may not be included, so you may have to login to the backend shell to collect these logs or execute some commands, for example, executing curl to verify if the backend servers is reachable.

Login to backend shell on 6.4 or 6.3 builds

It’s simple but really dangerous. The admin user can login to the backend shell with the root permission just by executing “fn sh”.

FWB # fn sh

/#

Login to backend shell on 7.0.0 and later builds

To access the backend shell, you need to enable shell-access and create a temporary user/password through CLI first, then login via SSH.

config system global

set shell-access enable

set shell-username <user_name>

set shell-password <password>

set shell-timeout 1200 #The shell-access will be disabled in 1200 minutes

end

Then you can login to the backend shell with a SSH client:

C:\>ssh shell@192.168.0.99

shell@192.168.0.99's password:

-- WARNING! All configurations should be done through CLI shell.

-- You now have full access.

/#

Use “fnsysctl” in CLI to execute backend commands

To simplify, you can execute some commonly used backend commands directly in FortiWeb CLI, without enabling shell-access and adding username/password.

On 7.0.3 and previous builds, below commands are supported:

FortiWeb # fnsysctl

Below are the usable commands:

basename cat date df dmesg

du ifconfig netstat nslookup ping

sleep uname ps kill killall

lspci df fdisk mount free

lsusb insmod mknod smartctl MegaCli ssh dmidecode pstack

strace tcpdump gdb

FortiWeb # fnsysctl df -h

Filesystem Size Used Available Use% Mounted on

/dev/root 472.5M 358.2M 114.4M 76% /

none 1.1G 44.3M 1.1G 4% /tmp

none 3.8G 3.0M 3.8G 0% /dev/shm

/dev/sda2 362.4M 271.5M 71.3M 79% /data

/dev/sda3 90.6M 56.0K 85.6M 0% /home

/dev/sda4 30.5G 4.1G 24.9G 14% /var/log

For security purpose, 7.0.4 and newer builds only support below commands:

FortiWeb # fnsysctl

Below are the usable commands:

basename date df dmesg ifconfig

netstat nslookup ping sleep uname

ps lspci free lsusb traceroute

pidof smartctl dmidecode nmon

Please note that some commands such as “fn pstack” and “fn ssh” are not supported. To collect the pstack information, you need to configure shell-access and login into the backend shell first.