How to secure the Forticlient VPN configuration ?

[#1]

Do you know if it is possible to avoid an unexpected user logged on a computer under winXP and Forticlient 2.0 installed for VPN access to steel the VPN configuration and simply import it somewhere else? I tried the preshared key and RSA signature authentification methods and observed same security problem : [ul]

Using XAuth, it seems not possible to avoid the VPN user to save the login/password asked before connecting. If he do this, the XAuth parameters are saved (with encryption) and may be exported by everybody the VPN configuration file. Next, this file could be imported somewhere else and the VPN connexion performed without any user authentification procedure.

So I tried to use pkcs12 certificate because of PIN pre-shared key needed for installation but this is not the solution because of free access for everybody to the fortinet/forticlient/cert/local directory used to keep private and public keys without any protection keys. [/ul] Any solution (except the client workstation securing)? Franck

[vanc]

From the FortiClient 2.0 Release Notes, you can add this registry value to prevent the client from prompting users to save the user/pass. 4.4 Disabling VPN XAuth password saving The ability for a user to “save” the VPN XAuth password can now be disabled through a registry setting in a custom installation. To disable this feature: 1. Create a new, or edit an existing, MSI transform file. 2. Edit the LOCAL_MACHINE\Software\Fortinet\FortiClient\FA_IKE registry key. 3. Add the value DontRememberPassword under the key. 4. Set the value of DontRememberPassword to 1.

[#3]

Thank you for the answer One told me that a strong authentification with usb token should be available in a future forticlient release, so I will wait. Franck

[vanc]

What kind of hardware token do you want to use? The special FortiClient builds only support Aladin eToken.

[#5]

Vanc, Is there a FortiClient that support eToken? Tell me, pls. Regards, Eric

[vanc]

Yes. There is one. But don' t ask me for the build. Support may give you one.