Handle pfSense config.xml as a reusable-credential bundle

Some service credentials must remain recoverable and are not protected like the administrator’s password hash.

Source facts

Netgate documents that several pfSense configuration credentials appear in plain text or reversible Base64, including LDAP bind passwords, RADIUS shared secrets, and IPsec shared secrets. Services needing the original credential cannot operate from a one-way hash. The system password is a different case and is stored as a hash.

Source: Netgate — Password Storage Security Policies.

Applicability

This concerns the sensitivity of pfSense configuration material.

DSE recommendation

DSE recommends restricting configuration-file and backup access to people authorized to use the embedded service credentials. Use approved encrypted storage and transfer rather than attaching XML to general support conversations. When sharing a diagnostic copy, review it for keys and reversible credentials using a controlled redaction process. If an unredacted copy is exposed, assess rotation of its service secrets alongside the firewall account password. Removing a local file does not revoke credentials already copied from it. Review access to historical copies as well as the newest backup. Give the incident owner a list of credential categories potentially present, without exposing their values, so a leak assessment can assign the appropriate service owners instead of stopping at a firewall password reset.

Verification

Review backup locations, access permissions, and transfer records without printing secret values. Confirm that a designated recovery administrator can retrieve the protected configuration while an ordinary operator cannot. Exercise the redaction workflow with a nonproduction configuration and inspect the resulting copy before adopting it for support use.

Official reference

Netgate — Password Storage Security Policies. Reviewed October 20, 2026.