{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/keep-both-pfsense-autoconfigbackup-recovery-secrets-outside-the-firewall/", "item": { "id": "https://update.dsesecurity.com/updates/keep-both-pfsense-autoconfigbackup-recovery-secrets-outside-the-firewall/", "slug": "keep-both-pfsense-autoconfigbackup-recovery-secrets-outside-the-firewall", "url": "https://update.dsesecurity.com/updates/keep-both-pfsense-autoconfigbackup-recovery-secrets-outside-the-firewall/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/keep-both-pfsense-autoconfigbackup-recovery-secrets-outside-the-firewall.md", "json": "https://update.dsesecurity.com/api/v1/posts/keep-both-pfsense-autoconfigbackup-recovery-secrets-outside-the-firewall/" }, "title": "Keep both pfSense AutoConfigBackup recovery secrets outside the firewall", "summary": "The device key identifies backups, while the encryption password is needed to read their contents.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:08+00:00", "modified_at": "2026-10-20T18:34:34+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 250, "potentially_affected": "This concerns AutoConfigBackup settings in pfSense.", "dse_recommendation": "DSE recommends storing the device key and encryption password in an approved restricted recovery vault accessible during a firewall outage.", "primary_source": { "name": "Netgate — AutoConfigBackup Configuration", "url": "https://docs.netgate.com/pfsense/en/latest/backup/acb-config.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

The device key identifies backups, while the encryption password is needed to read their contents.

\n

Source facts

\n

Netgate states that anyone possessing an AutoConfigBackup device key can manipulate backups associated with it. The separate encryption password is used locally and is not transmitted as a login credential. Losing that password prevents recovery of backup contents. Changing it affects new backups and leaves older entries dependent on the previous password.

\n

Source: Netgate — AutoConfigBackup Configuration.

\n

Applicability

\n

This concerns AutoConfigBackup settings in pfSense.

\n

DSE recommendation

\n

DSE recommends storing the device key and encryption password in an approved restricted recovery vault accessible during a firewall outage. Record password changes with the backup periods they protect. Keep enough historical secret material to recover retained backups instead of overwriting the only saved password during rotation. Limit who can retrieve the device key because its authority extends beyond merely viewing metadata. Assign a recovery owner and alternate who can follow the documented process without the original appliance. Keep a credential-to-backup-period index in the recovery vault without placing the values in ordinary documentation. Ask the alternate recovery owner to select the correct historical password using that index. A successful current-backup exercise should not substitute for testing one retained older generation.

\n

Verification

\n

Use an approved recovery exercise to retrieve a designated backup and decrypt it using the vaulted credentials. Repeat for an older retained entry after a password change. Record successful decryption without copying either secret into tickets, screenshots, or diagnostic logs.

\n

Official reference

\n

Netgate — AutoConfigBackup Configuration. Reviewed October 20, 2026.

", "content_text": "The device key identifies backups, while the encryption password is needed to read their contents.\nSource facts\nNetgate states that anyone possessing an AutoConfigBackup device key can manipulate backups associated with it. The separate encryption password is used locally and is not transmitted as a login credential. Losing that password prevents recovery of backup contents. Changing it affects new backups and leaves older entries dependent on the previous password.\nSource: Netgate — AutoConfigBackup Configuration.\nApplicability\nThis concerns AutoConfigBackup settings in pfSense.\nDSE recommendation\nDSE recommends storing the device key and encryption password in an approved restricted recovery vault accessible during a firewall outage. Record password changes with the backup periods they protect. Keep enough historical secret material to recover retained backups instead of overwriting the only saved password during rotation. Limit who can retrieve the device key because its authority extends beyond merely viewing metadata. Assign a recovery owner and alternate who can follow the documented process without the original appliance. Keep a credential-to-backup-period index in the recovery vault without placing the values in ordinary documentation. Ask the alternate recovery owner to select the correct historical password using that index. A successful current-backup exercise should not substitute for testing one retained older generation.\nVerification\nUse an approved recovery exercise to retrieve a designated backup and decrypt it using the vaulted credentials. Repeat for an older retained entry after a password change. Record successful decryption without copying either secret into tickets, screenshots, or diagnostic logs.\nOfficial reference\nNetgate — AutoConfigBackup Configuration. Reviewed October 20, 2026.", "content_markdown": "The device key identifies backups, while the encryption password is needed to read their contents.\n\n## Source facts\n\nNetgate states that anyone possessing an AutoConfigBackup device key can manipulate backups associated with it. The separate encryption password is used locally and is not transmitted as a login credential. Losing that password prevents recovery of backup contents. Changing it affects new backups and leaves older entries dependent on the previous password.\n\nSource: [Netgate — AutoConfigBackup Configuration](https://docs.netgate.com/pfsense/en/latest/backup/acb-config.html).\n\n## Applicability\n\nThis concerns AutoConfigBackup settings in pfSense.\n\n## DSE recommendation\n\nDSE recommends storing the device key and encryption password in an approved restricted recovery vault accessible during a firewall outage. Record password changes with the backup periods they protect. Keep enough historical secret material to recover retained backups instead of overwriting the only saved password during rotation. Limit who can retrieve the device key because its authority extends beyond merely viewing metadata. Assign a recovery owner and alternate who can follow the documented process without the original appliance. Keep a credential-to-backup-period index in the recovery vault without placing the values in ordinary documentation. Ask the alternate recovery owner to select the correct historical password using that index. A successful current-backup exercise should not substitute for testing one retained older generation.\n\n## Verification\n\nUse an approved recovery exercise to retrieve a designated backup and decrypt it using the vaulted credentials. Repeat for an older retained entry after a password change. Record successful decryption without copying either secret into tickets, screenshots, or diagnostic logs.\n\n## Official reference\n\n[Netgate — AutoConfigBackup Configuration](https://docs.netgate.com/pfsense/en/latest/backup/acb-config.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/keep-both-pfsense-autoconfigbackup-recovery-secrets-outside-the-firewall/", "url": "https://update.dsesecurity.com/updates/keep-both-pfsense-autoconfigbackup-recovery-secrets-outside-the-firewall/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/keep-both-pfsense-autoconfigbackup-recovery-secrets-outside-the-firewall/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Keep both pfSense AutoConfigBackup recovery secrets outside the firewall", "item": "https://update.dsesecurity.com/updates/keep-both-pfsense-autoconfigbackup-recovery-secrets-outside-the-firewall/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/keep-both-pfsense-autoconfigbackup-recovery-secrets-outside-the-firewall/#article", "identifier": "https://update.dsesecurity.com/updates/keep-both-pfsense-autoconfigbackup-recovery-secrets-outside-the-firewall/", "url": "https://update.dsesecurity.com/updates/keep-both-pfsense-autoconfigbackup-recovery-secrets-outside-the-firewall/", "headline": "Keep both pfSense AutoConfigBackup recovery secrets outside the firewall", "description": "The device key identifies backups, while the encryption password is needed to read their contents.", "abstract": "The device key identifies backups, while the encryption password is needed to read their contents.", "articleBody": "The device key identifies backups, while the encryption password is needed to read their contents.\nSource facts\nNetgate states that anyone possessing an AutoConfigBackup device key can manipulate backups associated with it. The separate encryption password is used locally and is not transmitted as a login credential. Losing that password prevents recovery of backup contents. Changing it affects new backups and leaves older entries dependent on the previous password.\nSource: Netgate — AutoConfigBackup Configuration.\nApplicability\nThis concerns AutoConfigBackup settings in pfSense.\nDSE recommendation\nDSE recommends storing the device key and encryption password in an approved restricted recovery vault accessible during a firewall outage. Record password changes with the backup periods they protect. Keep enough historical secret material to recover retained backups instead of overwriting the only saved password during rotation. Limit who can retrieve the device key because its authority extends beyond merely viewing metadata. Assign a recovery owner and alternate who can follow the documented process without the original appliance. Keep a credential-to-backup-period index in the recovery vault without placing the values in ordinary documentation. Ask the alternate recovery owner to select the correct historical password using that index. A successful current-backup exercise should not substitute for testing one retained older generation.\nVerification\nUse an approved recovery exercise to retrieve a designated backup and decrypt it using the vaulted credentials. Repeat for an older retained entry after a password change. Record successful decryption without copying either secret into tickets, screenshots, or diagnostic logs.\nOfficial reference\nNetgate — AutoConfigBackup Configuration. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:08+00:00", "dateModified": "2026-10-20T18:34:34+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/keep-both-pfsense-autoconfigbackup-recovery-secrets-outside-the-firewall/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/keep-both-pfsense-autoconfigbackup-recovery-secrets-outside-the-firewall/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep both pfSense AutoConfigBackup recovery secrets outside the firewall" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 250, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — AutoConfigBackup Configuration", "url": "https://docs.netgate.com/pfsense/en/latest/backup/acb-config.html" } } ] } }