Resetting a lost Admin password

来源 https://cookbook.fortinet.com/resetting-a-lost-admin-password/

Posted on October 10, 2018 by Bruce Davis

Periodically a situation arises where the FortiGate needs to be accessed or the admin account’s password needs to be changed but no one with the existing password is available. If you have physical access to the device and a few other tools the password can be reset.

Warning: This procedure will require the reboot of the FortiGate unit.


Update:

Once you have logged into your FortiGate with the maintainer account (as described below), if the FortiGate is running FortiOS 6.0.3 or later, you can enter the execute factoryreset command to return the FortiGate to its default configuration. This can be useful if you have deleted the admin administrator account.

In newer versions of the BIOS, you can expect some changes to the behaviour of the maintainer account. These changes will include:

  • The countdown timer for how log you have to enter the credentials has increased. Starting from when the device powers up, you will have 60 seconds instead of 30.
  • Using the maintainer account and resetting a password cause a log to be created; making these actions traceable for security purposes.
  • The account will be able to reset the password for any super-admin profile user in addition to the default admin user. This takes into account the possibility that the default account has been renamed.
  • The only thing the maintainer account has permissions to do is reset the passwords of super-admin profile accounts.

You will need:

  • Console cable
  • Terminal software such as Putty.exe (Windows) or Terminal (MacOS)
  • Serial number of the FortiGate device

Procedure

Step #1

Connect the computer to the firewall via the Console port on the back of the unit.

In most units this is done either by a Serial cable or a RJ-45 to Serial cable. There are some units that use a USB cable and FortiExplorer to connect to the console port.

Virtual instances will not have any physical port to connect to so you will have to use the supplied VM Hosts’ console connection utility.

Step #2

Start your terminal software.

Step #3

Connect to the firewall using the following:

Setting Value
Speed Baud 9600
Data Bits 8 Bit
Parity None
Stop Bits 1
Flow Control No Hardware Flow Control
Com Port the correct COM port

Step #4

The firewall should then respond with its name or hostname. (If it doesn’t try pressing “enter”.)

Step #5

Reboot the firewall. If there is no power button, disconnect the power adapter and reconnect it after 10 seconds. Plugging in the power too soon after unplugging it can cause corruption in the memory in some units.

Step #6

Wait for the Firewall name and login prompt to appear. The terminal window should display something similar to the following:

FortiGate-60C (18:52-06.18.2010)
Ver:04000010
Serial number: FGT60C3G10016011
CPU(00): 525MHz
Total RAM: 512 MB
NAND init... 128 MB
MAC Init... nplite#0
Press any key to display configuration menu...
......
reading boot image 1163092 bytes.
Initializing firewall...       
System is started.
login:

Step #7

Type in the username: maintainer

Step #8

The password is bcpb + the serial number of the firewall (letters of the serial number are in UPPERCASE format)

Example: bcpbFGT60C3G10016011

Note:

On some devices, after the device boots, you have only 14 seconds or less to type in the username and password. It might, therefore, be necessary to have the credentials ready in a text editor, and then copy and paste them into the login screen. There is no indicator of when your time runs out so it is possible that it might take more than one attempt to succeed.

Step #9

Now you should be connected to the firewall. To change the admin password you type the following…

In a unit where VDOMs are not enabled:

config system admin
edit admin
set password
end 

In a unit where VDOMs are enabled:

config global
config system admin
edit admin
set password
end

If the FortiGate is running FortiOS 6.0.3 or later you can also enter the following command to reset the FortiGate to its factory default configuration. This can be useful if you have deleted the admin administrator account.

execute factoryreset

Warning

Good news and bad news. Some might be worried that there is a backdoor into the system. The maintainer feature/account is enabled by default, but the good news is, if you wish, there is an option to disable this feature. The bad news is that if you disable the feature and lose the password without having someone else that can log in as a superadmin profile administrator you will be out of options.

If you attempt to use the maintainer account and see the message on the console, “PASSWORD RECOVERY FUNCTIONALITY IS DISABLED”, this means that the maintainer account has been disabled.

Disabling the maintainer feature/account

Use the following command in the CLI to change the status of the maintainer account

To disable

config system global
set admin-maintainer disable
end

To enable

config system global
set admin-maintainer enable
end

====================== End

Resetting a lost Admin password的更多相关文章

  1. 使用Docker Compose 部署Nexus后初次登录账号密码不正确,并且在nexus-data下没有admin,password

    场景 Ubuntu Server 上使用Docker Compose 部署Nexus(图文教程): https://blog.csdn.net/BADAO_LIUMANG_QIZHI/article/ ...

  2. Recover lost Confluence password

    confluence重置admin密码 复方法: 1. 运行此sql 找到你的管理员帐户: select u.id, u.user_name, u.active from cwd_user u joi ...

  3. how to reset mac root password

    Reset 10.5 Leopard & 10.6 Snow Leopard password Power on or restart your Mac. At the chime (or g ...

  4. Spring Boot Admin 的使用 2

    http://blog.csdn.net/kinginblue/article/details/52132113 ******************************************* ...

  5. Magento: How to reset admin pssword

    Magento: How to reset admin pssword If you forget your admin password for Magento and you can’t reme ...

  6. VSS Admin 清除密码

    [参阅链接]http://www.cnblogs.com/Zealot/archive/2004/09/18/44309.html the secret is to hack the um.dat f ...

  7. Spring Boot Admin Reference Guide

    1. What is Spring Boot Admin? Spring Boot Admin is a simple application to manage and monitor your S ...

  8. spring boot admin + spring boot actuator + erueka 微服务监控

    关于spring boot actuator简单使用,请看 简单的spring boot actuator 使用,点击这里 spring boot admin 最新的正式版本是1.5.3 与 spri ...

  9. Django通过pycharm创建后,如何登录admin后台?

    问题背景: 使用pycharm创建完成django项目(项目名称为:mydjangopro,app名称为my_blog) , 本想登录后台直接输入地址:http://127.0.0.1:8000/ad ...

随机推荐

  1. Window10家庭版启动hyper-v虚拟机组件

    在安装docker的时候发现如果直接使用docker for windows,对系统的要求是window10专业版或企业版,家庭版本身没有hyper-v,不能支持 虚拟化.但是后来我在搜索过程中发现, ...

  2. [codeForce-1006C]-Three Parts of the Array (简单题)

    You are given an array d1,d2,…,dnd1,d2,…,dn consisting of nn integer numbers. Your task is to split ...

  3. 一种利用ADO连接池操作MySQL的解决方案(VC++)

    VC++连接MySQL数据库 常用的方式有三种:ADO.mysql++,mysql API ; 本文只讲述ADO的连接方式. 为什么要使用连接池? 对于简单的数据库应用,完全可以先创建一个常连接(此连 ...

  4. 笨办法学Python - 习题6-7: Strings and Text & More Printing

    目录 1.习题 6: 字符串(string) 和文本 2.加分习题: 3.我的答案 4.习题总结 5.习题 7: 更多打印 6.习题总结 1.习题 6: 字符串(string) 和文本 学习目标:了解 ...

  5. dmesg命令详解

    基础命令学习目录 http://linux.cn/article-3587-1.html dmesg 命令的使用范例 下面我们展示一些最负盛名的‘dmesg’命令工具以及其实际使用举例.‘dmesg’ ...

  6. 使用OpenCV通过摄像头捕获实时视频并探测人脸

    在Opencv初接触,图片的基本操作这篇手记中,我介绍了一些图片的基本操作,视频可以看作是一帧一帧的图片,因此图片操作其实是视频操作的基础,这篇手记就来讲讲OpenCV中的视频操作,并实现一个用笔记本 ...

  7. “Hello World!”团队第五周第六次会议

    “Hello World!”团队第五周第六次会议   博客内容: 一.会议时间 二.会议地点 三.会议成员 四.会议内容 五.todo list 六.会议照片 七.燃尽图 八.checkout& ...

  8. bootstrap table的展开行问题

    照着网上与api里说的添加detailView属性设置为true,detailFormatter属性为展开后的内容,但是设置之后发现,在表格每一行最前面是多出一列正常该显示"+"的 ...

  9. iOS软件"一天八杯水“app开发过程

    作为一个ios系统测试者和app外观设计者.我们首先要了解iOS系统的开发工具和资源.xcode和iOS sdk作为一个免费的开发环境值得我们去学习和了解.interface builder提供创建了 ...

  10. 冲刺One之站立会议5 /2015-5-18

    2015-5-18 服务器部分大体已经完工,现在我们主要是在把登陆界面和服务器组装起来,这个过程是很让人头痛的,以为其中涉及到了很多网络协议.网络编程的知识,由于之前我们没有接触过所以实现起来会觉得很 ...