{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/handle-pfsense-config-xml-as-a-reusable-credential-bundle/", "item": { "id": "https://update.dsesecurity.com/updates/handle-pfsense-config-xml-as-a-reusable-credential-bundle/", "slug": "handle-pfsense-config-xml-as-a-reusable-credential-bundle", "url": "https://update.dsesecurity.com/updates/handle-pfsense-config-xml-as-a-reusable-credential-bundle/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/handle-pfsense-config-xml-as-a-reusable-credential-bundle.md", "json": "https://update.dsesecurity.com/api/v1/posts/handle-pfsense-config-xml-as-a-reusable-credential-bundle/" }, "title": "Handle pfSense config.xml as a reusable-credential bundle", "summary": "Some service credentials must remain recoverable and are not protected like the administrator's password hash.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "physical-security", "label": "Physical security", "alt": "Integrated video surveillance and controlled entry at a modern commercial facility.", "card_url": "https://update.dsesecurity.com/assets/editorial/physical-security-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/physical-security-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:11+00:00", "modified_at": "2026-10-20T18:34:34+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 260, "potentially_affected": "This concerns the sensitivity of pfSense configuration material.", "dse_recommendation": "DSE recommends restricting configuration-file and backup access to people authorized to use the embedded service credentials.", "primary_source": { "name": "Netgate — Password Storage Security Policies", "url": "https://docs.netgate.com/pfsense/en/latest/backup/password-security.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Some service credentials must remain recoverable and are not protected like the administrator’s password hash.

\n

Source facts

\n

Netgate documents that several pfSense configuration credentials appear in plain text or reversible Base64, including LDAP bind passwords, RADIUS shared secrets, and IPsec shared secrets. Services needing the original credential cannot operate from a one-way hash. The system password is a different case and is stored as a hash.

\n

Source: Netgate — Password Storage Security Policies.

\n

Applicability

\n

This concerns the sensitivity of pfSense configuration material.

\n

DSE recommendation

\n

DSE recommends restricting configuration-file and backup access to people authorized to use the embedded service credentials. Use approved encrypted storage and transfer rather than attaching XML to general support conversations. When sharing a diagnostic copy, review it for keys and reversible credentials using a controlled redaction process. If an unredacted copy is exposed, assess rotation of its service secrets alongside the firewall account password. Removing a local file does not revoke credentials already copied from it. Review access to historical copies as well as the newest backup. Give the incident owner a list of credential categories potentially present, without exposing their values, so a leak assessment can assign the appropriate service owners instead of stopping at a firewall password reset.

\n

Verification

\n

Review backup locations, access permissions, and transfer records without printing secret values. Confirm that a designated recovery administrator can retrieve the protected configuration while an ordinary operator cannot. Exercise the redaction workflow with a nonproduction configuration and inspect the resulting copy before adopting it for support use.

\n

Official reference

\n

Netgate — Password Storage Security Policies. Reviewed October 20, 2026.

", "content_text": "Some service credentials must remain recoverable and are not protected like the administrator’s password hash.\nSource facts\nNetgate documents that several pfSense configuration credentials appear in plain text or reversible Base64, including LDAP bind passwords, RADIUS shared secrets, and IPsec shared secrets. Services needing the original credential cannot operate from a one-way hash. The system password is a different case and is stored as a hash.\nSource: Netgate — Password Storage Security Policies.\nApplicability\nThis concerns the sensitivity of pfSense configuration material.\nDSE recommendation\nDSE recommends restricting configuration-file and backup access to people authorized to use the embedded service credentials. Use approved encrypted storage and transfer rather than attaching XML to general support conversations. When sharing a diagnostic copy, review it for keys and reversible credentials using a controlled redaction process. If an unredacted copy is exposed, assess rotation of its service secrets alongside the firewall account password. Removing a local file does not revoke credentials already copied from it. Review access to historical copies as well as the newest backup. Give the incident owner a list of credential categories potentially present, without exposing their values, so a leak assessment can assign the appropriate service owners instead of stopping at a firewall password reset.\nVerification\nReview backup locations, access permissions, and transfer records without printing secret values. Confirm that a designated recovery administrator can retrieve the protected configuration while an ordinary operator cannot. Exercise the redaction workflow with a nonproduction configuration and inspect the resulting copy before adopting it for support use.\nOfficial reference\nNetgate — Password Storage Security Policies. Reviewed October 20, 2026.", "content_markdown": "Some service credentials must remain recoverable and are not protected like the administrator’s password hash.\n\n## Source facts\n\nNetgate documents that several pfSense configuration credentials appear in plain text or reversible Base64, including LDAP bind passwords, RADIUS shared secrets, and IPsec shared secrets. Services needing the original credential cannot operate from a one-way hash. The system password is a different case and is stored as a hash.\n\nSource: [Netgate — Password Storage Security Policies](https://docs.netgate.com/pfsense/en/latest/backup/password-security.html).\n\n## Applicability\n\nThis concerns the sensitivity of pfSense configuration material.\n\n## DSE recommendation\n\nDSE recommends restricting configuration-file and backup access to people authorized to use the embedded service credentials. Use approved encrypted storage and transfer rather than attaching XML to general support conversations. When sharing a diagnostic copy, review it for keys and reversible credentials using a controlled redaction process. If an unredacted copy is exposed, assess rotation of its service secrets alongside the firewall account password. Removing a local file does not revoke credentials already copied from it. Review access to historical copies as well as the newest backup. Give the incident owner a list of credential categories potentially present, without exposing their values, so a leak assessment can assign the appropriate service owners instead of stopping at a firewall password reset.\n\n## Verification\n\nReview backup locations, access permissions, and transfer records without printing secret values. Confirm that a designated recovery administrator can retrieve the protected configuration while an ordinary operator cannot. Exercise the redaction workflow with a nonproduction configuration and inspect the resulting copy before adopting it for support use.\n\n## Official reference\n\n[Netgate — Password Storage Security Policies](https://docs.netgate.com/pfsense/en/latest/backup/password-security.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/handle-pfsense-config-xml-as-a-reusable-credential-bundle/", "url": "https://update.dsesecurity.com/updates/handle-pfsense-config-xml-as-a-reusable-credential-bundle/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/handle-pfsense-config-xml-as-a-reusable-credential-bundle/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Handle pfSense config.xml as a reusable-credential bundle", "item": "https://update.dsesecurity.com/updates/handle-pfsense-config-xml-as-a-reusable-credential-bundle/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/handle-pfsense-config-xml-as-a-reusable-credential-bundle/#article", "identifier": "https://update.dsesecurity.com/updates/handle-pfsense-config-xml-as-a-reusable-credential-bundle/", "url": "https://update.dsesecurity.com/updates/handle-pfsense-config-xml-as-a-reusable-credential-bundle/", "headline": "Handle pfSense config.xml as a reusable-credential bundle", "description": "Some service credentials must remain recoverable and are not protected like the administrator's password hash.", "abstract": "Some service credentials must remain recoverable and are not protected like the administrator's password hash.", "articleBody": "Some service credentials must remain recoverable and are not protected like the administrator’s password hash.\nSource facts\nNetgate documents that several pfSense configuration credentials appear in plain text or reversible Base64, including LDAP bind passwords, RADIUS shared secrets, and IPsec shared secrets. Services needing the original credential cannot operate from a one-way hash. The system password is a different case and is stored as a hash.\nSource: Netgate — Password Storage Security Policies.\nApplicability\nThis concerns the sensitivity of pfSense configuration material.\nDSE recommendation\nDSE recommends restricting configuration-file and backup access to people authorized to use the embedded service credentials. Use approved encrypted storage and transfer rather than attaching XML to general support conversations. When sharing a diagnostic copy, review it for keys and reversible credentials using a controlled redaction process. If an unredacted copy is exposed, assess rotation of its service secrets alongside the firewall account password. Removing a local file does not revoke credentials already copied from it. Review access to historical copies as well as the newest backup. Give the incident owner a list of credential categories potentially present, without exposing their values, so a leak assessment can assign the appropriate service owners instead of stopping at a firewall password reset.\nVerification\nReview backup locations, access permissions, and transfer records without printing secret values. Confirm that a designated recovery administrator can retrieve the protected configuration while an ordinary operator cannot. Exercise the redaction workflow with a nonproduction configuration and inspect the resulting copy before adopting it for support use.\nOfficial reference\nNetgate — Password Storage Security Policies. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:11+00:00", "dateModified": "2026-10-20T18:34:34+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/handle-pfsense-config-xml-as-a-reusable-credential-bundle/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/handle-pfsense-config-xml-as-a-reusable-credential-bundle/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Handle pfSense config.xml as a reusable-credential bundle" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 260, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — Password Storage Security Policies", "url": "https://docs.netgate.com/pfsense/en/latest/backup/password-security.html" } } ] } }