FortiClient username and password encryption for windows

[peter123]

Hello,

you write the properties for each connections to the registry for windows (see HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FortiClient\Sslvpn\Tunnels\).

There are the reg strings DATA1 (username), DATA2 (password) and DATA3. How do you encrypt the password? What is the key? And for what is DATA3?

[ede_pfau]

No, you don't.

At least this is not the way you configure FC. It's precisely what you are asking for that there is the 'official' way of configuring username, password and other detail info.

Storing username and/or password on a mobile device is a no-go anyway. If you let that happen (even for your notebook) you weaken your security a lot.

If you do have to provision configs from the command line, you can create the XML config file which is written in cleartext, and then load or have your users load it into the FC. Here again, this is not the way it's designed - for provisioning and deployment there is the (Windows) EMS.

[peter123]

Hello ede_pfau,

> Storing username and/or password on a mobile device is a no-go anyway. If you let that happen (even for your notebook) you weaken your security a lot.

The FortiClient save the password on your device! See the DATA2 entry. And the key have to be also at the device. So I asking for interests what a cipher they use and what the key is.

It would be better if the FortiClient would use the Protected Storage from Windows actually.