This document describes security best practices when using OpenFortiVPN on GNU/Linux systems.

The goal is to reduce the risk of credential leakage, unauthorized access, and accidental exposure of VPN-related information.

Whenever possible, use SAML authentication.

Benefits:

• No password storage in configuration files
• Centralized identity management
• Multi-factor authentication support
• Improved auditing
• Reduced credential exposure

Example:

vpn-saml

or:

sudo openfortivpn vpn.example.com:443 --saml-login

Avoid configurations like:

username = myuser
password = mypassword

Although supported by OpenFortiVPN, storing passwords in plain text increases risk.

Prefer:

SAML Authentication

whenever available.

Never commit files containing:

username =
password =
trusted-cert =

or any internal VPN configuration.

Examples:

openfortivpn-config
.env
vpn.conf

Add sensitive files to:

.gitignore

Example:

openfortivpn-config
*.vpn
*.conf.local
.env

If a configuration file must exist locally:

chmod 600 openfortivpn-config

Verify:

ls -l openfortivpn-config

Expected:

-rw-------

Only the owner should have access.

Commands containing credentials may be stored in shell history.

Avoid:

openfortivpn vpn.example.com --username user --password password

Use:

SAML authentication

or configuration files with restricted permissions.

Logs may contain:

• usernames
• internal hostnames
• internal IP addresses
• routing information

Before sharing logs:

Remove:

Usernames
Hostnames
IP addresses
Domains
Tokens

Always download OpenFortiVPN from trusted sources.

Recommended:

Official GitHub repository
Official distribution repositories

Avoid:

Unknown mirrors
Untrusted package repositories
Random binaries

Check:

openfortivpn --version

Keep the client updated.

New releases may include:

• security fixes
• authentication improvements
• compatibility updates

If supported by the identity provider:

Enable:

Multi-Factor Authentication

Examples:

• Microsoft Entra ID
• Azure AD
• Okta
• Google Workspace

MFA significantly reduces account compromise risk.

Terminate VPN sessions when work is complete.

Disconnect:

CTRL + C

Avoid leaving VPN sessions active unnecessarily.

Check processes:

ps aux | grep openfortivpn

Check interfaces:

ip addr

Review active connections periodically.

Avoid VPN usage on:

• public computers
• shared workstations
• unmanaged systems

Use only trusted devices.

Always follow your organization's:

• VPN policies
• authentication policies
• security requirements
• endpoint requirements

OpenFortiVPN should not be used to bypass organizational security controls.

Before connecting:

✓ OpenFortiVPN updated
✓ SAML authentication enabled
✓ MFA enabled
✓ No passwords stored in Git repositories
✓ Sensitive files protected with chmod 600
✓ Trusted network connection

After disconnecting:

✓ VPN session terminated
✓ No sensitive logs shared publicly
✓ No credentials exposed

Following these practices significantly reduces security risks while using OpenFortiVPN.