Do not equate pfSense Deny Config Write with a harmless operator role

Preventing config.xml changes does not prevent every operational action.

Source facts

Netgate warns that User – Config – Deny Config Write prevents configuration-file changes but does not prevent other actions that do not write configuration. Page privileges separately control GUI access. Dashboard privileges expose associated functions, while the password-manager-only privilege can permit a user to change their own password without other GUI access.

Source: Netgate — Privileges.

Applicability

This concerns pfSense local user and group privileges.

DSE recommendation

DSE recommends designing an operator role from the required tasks and reviewing each granted page’s actual controls. Apply Deny Config Write as one restriction rather than the whole design. Separate password self-service from diagnostic access where that is the business need. Include inherited group privileges in the review and document which actions the role must never perform. Avoid testing the role while signed in as an administrator, whose access can hide missing restrictions. Define the operator role as a list of allowed and prohibited actions, then compare those actions with the assigned pages and privileges. Include a harmless representative operational action in a lab role review rather than calling the account read-only because one configuration write was denied.

Verification

Sign in with a dedicated test user carrying the proposed effective privileges. Check the required pages, unavailable pages, and operational controls without triggering disruptive actions. Verify configuration writes are denied and separately inspect any remaining restart, diagnostic, or runtime actions before approving the role.

Official reference

Netgate — Privileges. Reviewed October 20, 2026.