Privilege level for FortiOS

We use Unix authentication for scanning hardware devices that use the FortiOS operating system. The account you provide for authentication must have permission to run certain commands.

This help includes how to set up an administrator profile with the network group configuration set to read or read/write permission, and then assign that profile to the scan user account.

Commands required for scanning

get system status
show full-configuration system accprofile
show full-configuration system admin
show full-configuration system auto-install
show full-configuration system global
show full-configuration system interface
show full-configuration system ntp
show full-configuration system password-policy
show full-configuration system replacemsg admin pre_admin-disclaimer-text

Scan user account requirements

The user account you provide for authentication must have access to run the commands mentioned above.

You can provide any Administrator user with the network group configuration set to read or read/write permissions.

Steps using CLI

  1. Create a new profile or edit an existing profile with the following configuration or higher:
    Fortinet # config global # Only for the VDOM target
    Fortinet (global) or Fortinet # config system accprofile
    Fortinet (accprofile) # edit
    Fortinet ( ) # set secfabgrp read
    Fortinet ( ) # set authgrp read
    Fortinet ( ) # set loggrp read
    Fortinet ( ) # set fwgrp read
    Fortinet ( ) # set vpngrp read
    Fortinet ( ) # set utmgrp read
    Fortinet ( ) # set wanoptgrp read
    Fortinet ( ) # set wifi read
    Fortinet ( ) # set ftviewgrp read
    Fortinet ( ) # set sysgrp custom
    Fortinet ( ) # set netgrp custom
    Fortinet ( ) # config netgrp-permission
    Fortinet (netgrp-permission) # set cfg read
    Fortinet (netgrp-permission) # set route-cfg read
    Fortinet (netgrp-permission) # end
    Fortinet ( ) # config sysgrp-permission
    Fortinet (sysgrp-permission) # set admin read-write
    Fortinet (sysgrp-permission) # set cfg read-write
    Fortinet (sysgrp-permission) # set upd read
    Fortinet (sysgrp-permission) # set mnt read
    Fortinet (sysgrp-permission) # end
    Fortinet ( ) # set cli-diagnose enable
    Fortinet ( ) # set cli-get enable
    Fortinet ( ) # set cli-exec enable
    Fortinet ( ) # set cli-show enable
    Fortinet ( ) # set cli-config enable
    Fortinet ( ) # end
  2. Add the above-created profile to the scan user account.

    Fortinet # config system admin
    Fortinet (admin) # edit <Scan User>
    Fortinet (scanuser) # set accprofile <Profile Name>

    config system admin
      edit "<User Name>"
          set accprofile "<Profile Name>"
      next
    end

The CLI permissions are added to FortiGate OS 7.4.2.

Before FortiOS 7.4.2

In earlier versions than FortiOS 7.4.2, the system does not separate CLI access into granular get, show, exec, and diagnose commands. Instead, the system ties CLI permissions directly to GUI access permissions. For more information, refer to CLI system permissions.

Validate Profile Configuration

Fortinet # show system accprofile <profile_name>
config system accprofile
    edit "profile_name"
        set secfabgrp read
        set ftviewgrp read
        set authgrp read-write
        set sysgrp custom
        set netgrp custom
        set loggrp read
        set fwgrp read
        set vpngrp read
        set utmgrp read
        set wanoptgrp read
        set wifi read
        set cli-diagnose enable
        set cli-get enable
        set cli-show enable
        set cli-exec enable
        set cli-config enable
        config netgrp-permission
            set cfg read
            set route-cfg read
        end
        config sysgrp-permission
            set admin read-write
            set upd read
            set cfg read-write
            set mnt read
        end
    next
end

Steps using web UI

To create a new profile or edit an existing profile:

  1. Sign in to the UI as an Admin user.
  2. Navigate to System > Admin Profiles.
  3. Click Create New.
  4. Type a user name and comment (Comment is optional).
  5. Provide the following access permissions:
    1. Provide the Read access to Security Fabric, Firewall, and Log & Report.
    2. Provide the Read-Write access to User & Device.
    3. Under Network > provide the Read access to Configuration and Router.
    4. Under System > provide the Read-Write access to Administrator Users
    5. Under System > provide the Read access to FortiGuard Updates, Configuration, and Maintenance.
    6. Provide the Read to Security Profile.
    7. Provide the Read Access to VPN, WAN Opt & Cache, and Wifi & Switch.
    8. Set Permit usage of CLI Commands to Enable.

Create an Admin User for Scan

Steps Using CLI

  1. Create an admin user for scan using CLI:
    Fortinet # config global # Only for the VDOM target
     Fortinet (global) or Fortinet # config system admin (To Create Administrator User for scanning)
    Fortinet (admin) # edit "scan_user" # New User will be created with the name specified inside double quotes
    new entry 'scan_user' added
    Fortinet (scan_user) # set accprofile profile_name
    Fortinet (scan_user) # set password <New User Password>
    Please enter current administrator password: *********
    Fortinet (scan_user) # set vdom root   # Mandatory for VDOM Target/Optional for Non VDOM Target
    Fortinet (scan_user) # end
    Please enter current administrator password: *********
  2. Validate the profile admin setting:
    Fortinet # show system admin scan_user
    config system admin
        edit "scan_user"
            set accprofile "profile_name"
            set vdom "root"
            set password ........
        next
    end

Steps using web UI

  1. Browse for the link https://<server_ip>, and sign in as an Admin user.
  2. Navigate to System > Admin Profiles.
  3. Click Create New > Administrator.
  4. In the Username box, type a correct user name.
  5. In the Type list, click Local User.
  6. In the Password and Conform Password boxes, type a password.
  7. In the Administrator Profile list, click a newly created profile. For more information, see Create an Admin User for Scan.
  8. Click OK.

Edit Administrator

Commands for Scanning

diagnose debug info
diagnose sys ntp status
execute log display
get firewall policy
get router info routing-table static
get system info admin ssh
get system interface
get system status
show antivirus profile
show full-configuration
show full-configuration antivirus heuristic
show full-configuration antivirus profile
show full-configuration antivirus settings
show full-configuration application list
show full-configuration authentication scheme
show full-configuration dnsfilter profile
show full-configuration firewall DoS-policy
show full-configuration firewall local-in-policy
show full-configuration firewall policy
show full-configuration firewall service custom
show full-configuration firewall ssl setting
show full-configuration firewall ssl-ssh-profile
show full-configuration ips global
show full-configuration ips sensor
show full-configuration log disk setting
show full-configuration log eventfilter
show full-configuration log fortianalyzer2 setting
show full-configuration log fortianalyzer3 setting
show full-configuration log fortianalyzer setting
show full-configuration log fortianalyzer setting
show full-configuration log memory setting
show full-configuration log setting
show full-configuration log syslogd2 setting
show full-configuration log syslogd3 setting
show full-configuration log syslogd4 setting
show full-configuration log syslogd setting
show full-configuration router bgp
show full-configuration system accprofile
show full-configuration system admin
show full-configuration system auto-install
show full-configuration system automation-stitch
show full-configuration system autoupdate push-update
show full-configuration system autoupdate schedule
show full-configuration system csf
show full-configuration system dhcp server
show full-configuration system dns
show full-configuration system fortiguard
show full-configuration system global
show full-configuration system ha
show full-configuration system interface
show full-configuration system interface ssl.root
show full-configuration system netflow
show full-configuration system ntp
show full-configuration system password-policy
show full-configuration system password-policy
show full-configuration system proxy-arp
show full-configuration system replacemsg admin
show full-configuration system replacemsg admin pre_admin-disclaimer-text
show full-configuration system session-helper
show full-configuration system settings
show full-configuration system snmp community
show full-configuration system snmp sysinfo
show full-configuration system snmp user
show full-configuration system zone
show full-configuration user group
show full-configuration user ldap
show full-configuration user local
show full-configuration user radius
show full-configuration user setting
show full-configuration user tacacs
show full-configuration user tacacs+
show full-configuration vpn ssl settings
show full-configuration webfilter profile
show log syslogd setting
show system snmp community
show user local
show user tacacs+

Quick Links

Why use host authentication?

Set Up Unix Authentication

 

© 2026 Qualys, Inc. All rights reserved. Privacy Policy. Last updated: July, 2026