Fortinet 610 FortiWeb 5.0 Patch 6 Administration Guide
Figure 71:New Administrator dialog in System > Admin > Administrators
• Do not use the default administrator access profile for all new administrators. Create one or
more access profiles with limited permissions tailored to the responsibilities of the new
administrator accounts. See “Configuring access profiles” on page 216.
• By default, an administrator login that is idle for more than five minutes times out. You can
change this to a longer period in Idle Timeout, but Fortinet does not recommend it. Left
unattended, a web UI or CLI session could allow anyone with physical access to your
computer to change FortiWeb settings. Small idle timeouts mitigate this risk.
• Administrator passwords should be at least 8 characters long and include both numbers and
letters. For additional security, use Enable Strong Passwords to force the use of stronger
passwords. See “Global web UI & CLI settings” on page 51.
Figure 72:Strengthening passwords and the idle timeout System > Admin > Settings
• Restrict administrative access to a single network interface (usually port1), and allow only
the management access protocols needed.