Save Password on VPN Client with PIX

[mishag]

I am running a PIX 515 6.1(2) configured for a small number of VPN clients. I want the VPN clients to automatically remember the login password so users don't have to type it each time (we have an application that periodically autoconnects).

Whilst this is a configurable option with the 3000 series concentrators it doesn't appear to be configurable with the PIX.

The one work around I can find is to make the connection file (.pcf) read only and set SaveUserPassword=1. The problem

is that the password then needs to be stored as clear text in the file and it becomes awkward for the user to change their password.

Does anyone know if the command exists on the PIX to enable the VPN client to save the login password?

Thanks

Misha

[gfullage · Accepted solution]

The command to do this is not currently available on the PIX. It has just been included into the IOS EZVPN server functionality, but haven't heard of anything as yet as to whether it'll be included into the PIX.

If you would like this functionality, please feel free to contact your Account Manager and have them push for it, the more customers that ask for a new feature the faster it gets in.

[mishag]

There is a work around I have found, however it compromises security.

You can force the software to save the password by adding the option in the ini file and making it read only. However, this means the password is stored in the file in plain text and could be read by anyone who has access to the PC. Also, if the user changed their windows password you would need to edit the file again.

I am surprised that it is possible as any user could do this on their system and the network administrators have no way of restricting against it.

[mostiguy]

It might be possible to have admins precreate the connection profile, and then lock down the directory's permissions with NTFS (provided we are talking about a nt based OS)