Possibily to disable local admins and log in everywhere with Nebula account

nielsscheldeman

Security idea: why is the local admin on firewalls still enabled after they are joined on Nebula?

Why not only allow to log in on Security appliances with Nebula account and maybelocal admin account as applied in site settings with password random generated per organization in Nebula?

I now always get warning to enable 2FA on my appliances, but if local admin would be disabled, it would be better.

Zyxel_Melen

Hi @nielsscheldeman

To better discussing about this idea, please allow me to separate this to two part:

1. Log in on Security appliances with Nebula account or site-wide admin with random password.
2. Disable local admins.

Let me start part 2 first. If you are talking about H series (I think of course since USG FLEX/ATP series doesn't enable local admin when using Nebula mode), this is because H series not just allows to be configured on Nebula but also can be configured on local GUI. Since that, creating an admin account is available on local GUI. If you want to disable the default local admin account, you need to:

1. Upgrade to V1.38.
2. Create a new admin account.
3. Access User & Authentication > User/Group > User > Local Administrator > edit admin.
4. Disable it and save.

Additionally, if you select Nebula mode via start-up wizard, the local admin account will be applied in site settings with password random generated per site, which might match part 1 requirement.