# Handle pfSense config.xml as a reusable-credential bundle

> Some service credentials must remain recoverable and are not protected like the administrator's password hash.

- Canonical URL: https://update.dsesecurity.com/updates/handle-pfsense-config-xml-as-a-reusable-credential-bundle/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:11+00:00
- Modified: 2026-10-20T18:34:34+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Some service credentials must remain recoverable and are not protected like the administrator's password hash.

## Potentially affected

This concerns the sensitivity of pfSense configuration material.

## DSE recommendation

DSE recommends restricting configuration-file and backup access to people authorized to use the embedded service credentials.

## Article

Some service credentials must remain recoverable and are not protected like the administrator’s password hash.

## Source facts

Netgate documents that several pfSense configuration credentials appear in plain text or reversible Base64, including LDAP bind passwords, RADIUS shared secrets, and IPsec shared secrets. Services needing the original credential cannot operate from a one-way hash. The system password is a different case and is stored as a hash.

Source: [Netgate — Password Storage Security Policies](https://docs.netgate.com/pfsense/en/latest/backup/password-security.html).

## Applicability

This concerns the sensitivity of pfSense configuration material.

## DSE recommendation

DSE recommends restricting configuration-file and backup access to people authorized to use the embedded service credentials. Use approved encrypted storage and transfer rather than attaching XML to general support conversations. When sharing a diagnostic copy, review it for keys and reversible credentials using a controlled redaction process. If an unredacted copy is exposed, assess rotation of its service secrets alongside the firewall account password. Removing a local file does not revoke credentials already copied from it. Review access to historical copies as well as the newest backup. Give the incident owner a list of credential categories potentially present, without exposing their values, so a leak assessment can assign the appropriate service owners instead of stopping at a firewall password reset.

## Verification

Review backup locations, access permissions, and transfer records without printing secret values. Confirm that a designated recovery administrator can retrieve the protected configuration while an ordinary operator cannot. Exercise the redaction workflow with a nonproduction configuration and inspect the resulting copy before adopting it for support use.

## Official reference

[Netgate — Password Storage Security Policies](https://docs.netgate.com/pfsense/en/latest/backup/password-security.html). Reviewed October 20, 2026.

## Primary reference

- Name: Netgate — Password Storage Security Policies
- Authority: docs.netgate.com
- URL: https://docs.netgate.com/pfsense/en/latest/backup/password-security.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Handle pfSense config.xml as a reusable-credential bundle,” DSE Security, https://update.dsesecurity.com/updates/handle-pfsense-config-xml-as-a-reusable-credential-bundle/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.