# Do not equate pfSense Deny Config Write with a harmless operator role

> Preventing config.xml changes does not prevent every operational action.

- Canonical URL: https://update.dsesecurity.com/updates/do-not-equate-pfsense-deny-config-write-with-a-harmless-operator-role/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:15+00:00
- Modified: 2026-10-20T18:34:35+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Preventing config.xml changes does not prevent every operational action.

## Potentially affected

This concerns pfSense local user and group privileges.

## DSE recommendation

DSE recommends designing an operator role from the required tasks and reviewing each granted page's actual controls.

## Article

Preventing config.xml changes does not prevent every operational action.

## Source facts

Netgate warns that User – Config – Deny Config Write prevents configuration-file changes but does not prevent other actions that do not write configuration. Page privileges separately control GUI access. Dashboard privileges expose associated functions, while the password-manager-only privilege can permit a user to change their own password without other GUI access.

Source: [Netgate — Privileges](https://docs.netgate.com/pfsense/en/latest/usermanager/privileges.html).

## Applicability

This concerns pfSense local user and group privileges.

## DSE recommendation

DSE recommends designing an operator role from the required tasks and reviewing each granted page’s actual controls. Apply Deny Config Write as one restriction rather than the whole design. Separate password self-service from diagnostic access where that is the business need. Include inherited group privileges in the review and document which actions the role must never perform. Avoid testing the role while signed in as an administrator, whose access can hide missing restrictions. Define the operator role as a list of allowed and prohibited actions, then compare those actions with the assigned pages and privileges. Include a harmless representative operational action in a lab role review rather than calling the account read-only because one configuration write was denied.

## Verification

Sign in with a dedicated test user carrying the proposed effective privileges. Check the required pages, unavailable pages, and operational controls without triggering disruptive actions. Verify configuration writes are denied and separately inspect any remaining restart, diagnostic, or runtime actions before approving the role.

## Official reference

[Netgate — Privileges](https://docs.netgate.com/pfsense/en/latest/usermanager/privileges.html). Reviewed October 20, 2026.

## Primary reference

- Name: Netgate — Privileges
- Authority: docs.netgate.com
- URL: https://docs.netgate.com/pfsense/en/latest/usermanager/privileges.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Do not equate pfSense Deny Config Write with a harmless operator role,” DSE Security, https://update.dsesecurity.com/updates/do-not-equate-pfsense-deny-config-write-with-a-harmless-operator-role/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.