FortiPAM with TPM

FortiPAM supports TPM (Trusted Platform Module) to improve protection for secret credentials.

TPM should be enabled when you initially install FortiPAM. If you enable TPM after secrets have been configured on FortiPAM, secret credentials may be corrupted.

To check if the FortiPAM hardware device has TPM capability:

1. Before enabling TPM on FortiPAM, enter the following CLI command:

   diagnose tpm selftest

   If the output is Successfully tested. Works as expected, then TPM is installed on your FortiPAM hardware device.

To enable TPM on FortiPAM hardware device:

1. In the CLI console, enter the following commands:

   config system global

   set private-data-encryption enable

   end

FortiPAM-VM with vTPM enabled

If FortiPAM is a VM instance, the vTPM (virtual TPM) package must be installed, and vTPM enabled then.

See Appendix C: Installing vTPM package on KVM and adding vTPM to FortiPAM-VM.

On FortiPAM-VM, TPM can only be enabled after enabling vTPM.

To enable vTPM on FortiPAM-VM:

1. In the CLI console, enter the following commands:

   config system global

   set v-tpm enable

   end

To enable TPM on FortiPAM-VM:

FortiPAM-VM must be in maintenance mode to change TPM settings.

1. In the CLI console, enter the following commands:

   config sys maintenance

   set mode enable

   end

   config system global

   set private-data-encryption enable

   end

   Be carefull!!!This operation will refresh all ciphered data!

   Backup the current configuration file at first!

   Do you want to continue? (y/n)y

   Please type your private data encryption key (32 hexadecimal numbers):

   0123456789abcdef0123456789abcdef

   Please re-enter your private data encryption key (32 hexadecimal numbers) again:

   0123456789abcdef0123456789abcdef

   Your private data encryption key is accepted.

   The key must be the same for data restoration between source FortiPAM and destination FortiPAM.

To disable TPM:

1. In the CLI console, enter the following commands:

   config sys maintenance

   set mode enable

   end

   config system global

   set private-data-encryption disable

   end

   Be carefull!!!This operation will refresh all ciphered data!

   +Backup the current configuration file at first!

   +Do you want to continue? (y/n)y

   For FortiPAM-VM, vTPM should be disabled after disabling TPM.

To disable vTPM for FortiPAM-VM:

1. In the CLI console, enter the following commands:

   config system global

   set v-tpm disable

   end

   This operation will stop using vTPM module

   Do you want to continue? (y/n)y