To manage login usernames and admin roles in the web console. By default, the account and password of the admin account are admin and "admin". Navigate to System > Administrator. On the Administrator page, you can add, edit, delete, enable, and disable the admin account.

You can also specify the logged-in users who can manage the device through the console.

By default, four admin roles are available, including Ordinary Admin, Security Admin, Audit Admin, and System Admin.

Click Add. Then, the Add Administrator dialog box appears. See the figure below.

Username: Specify the name of the admin account.

Status: Specify whether the admin account is enabled or disabled.

Description: Enter a description for the account.

Auth Method: Support Local Authentication, Remote Authentication, and Remote/Local Authentication. Remote Authentication is not selected for created accounts. When Remote/Local Authentication is selected, local authentication is used when the external authentication server cannot be accessed.

Role: Specify the role of the admin account. You can select one of the five roles from the drop-down list, in which the system administrator, audit administrator, and security administrator are three separate accounts.

• Ordinary admin: Indicates an ordinary admin account that is granted permission to manage all modules.

• System admin: Responsible for the management and maintenance of daily running environments of software. This account is granted permission to configure basic network environments and other management permissions irrelevant to security policies.

• Security admin: Has the permission to view and modify modules related to security policies.

• Audit admin: Only has permission to view the built-in data center.

• Remote authentication user: You can select a user account on the external server as an admin account.

Login Security: Specify the authentication policy and management method of the admin account.

Local Authentication: Change the password of the current administrator account.

Multi-Factor Authentication: Select Enable email authentication and Enable TOTP authentication as needed.

Enable email authentication: Select whether to enable email authentication for an administrator in addition to the local password authentication. If this check box is selected, you need to further specify the email address of the administrator for whom you want to enable email authentication.

To enable email authentication for a regular administrator, you only need to specify the email address.

To enable email authentication for a super administrator, you need to specify the email address and enter a valid email verification code. This is because a super administrator is of critical importance. After the email address of the super administrator is specified, the system will send a verification code to that address for confirmation. This prevents issues such as mail server configuration errors.

Enable TOTP authentication: Select whether to enable TOTP authentication for an administrator in addition to the local password authentication. Administrators can bind their accounts to a TOTP secret key during account editing or the login process. As the super administrator is of critical importance, TOTP authentication can be enabled for the super administrator only after the super administrator is successfully bound to the TOTP secret key. This prevents login failures due to inaccurate time.

[sa28]Management Method: Specify the method for managing the device by the admin account. You can select one of the following four management methods:

Web UI: This allows you to log in to the management device using the admin account via web UI or webpage.

Web API: Allows the third-party platform to log in to the management device by performing web API operations.

SSH: Allow you to log in and manage devices via SSH.

Page Privileges: Specify whether the account has permission to view or edit modules in the console or data center.

Click Password Security Policy to set the security policy by which the console manages the admin password. You can set whether the password must be changed for the next login and the maximum number of days during which the password is available. Note: Only the admin account is granted this permission.

Only the admin account is granted this permission.

Click External Auth Server to authenticate the admin account of the external server. You can select TACACS or RADIUS for the Authentication Method parameter. See the figure below.