# Keep both pfSense AutoConfigBackup recovery secrets outside the firewall

> The device key identifies backups, while the encryption password is needed to read their contents.

- Canonical URL: https://update.dsesecurity.com/updates/keep-both-pfsense-autoconfigbackup-recovery-secrets-outside-the-firewall/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:08+00:00
- Modified: 2026-10-20T18:34:34+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

The device key identifies backups, while the encryption password is needed to read their contents.

## Potentially affected

This concerns AutoConfigBackup settings in pfSense.

## DSE recommendation

DSE recommends storing the device key and encryption password in an approved restricted recovery vault accessible during a firewall outage.

## Article

The device key identifies backups, while the encryption password is needed to read their contents.

## Source facts

Netgate states that anyone possessing an AutoConfigBackup device key can manipulate backups associated with it. The separate encryption password is used locally and is not transmitted as a login credential. Losing that password prevents recovery of backup contents. Changing it affects new backups and leaves older entries dependent on the previous password.

Source: [Netgate — AutoConfigBackup Configuration](https://docs.netgate.com/pfsense/en/latest/backup/acb-config.html).

## Applicability

This concerns AutoConfigBackup settings in pfSense.

## DSE recommendation

DSE recommends storing the device key and encryption password in an approved restricted recovery vault accessible during a firewall outage. Record password changes with the backup periods they protect. Keep enough historical secret material to recover retained backups instead of overwriting the only saved password during rotation. Limit who can retrieve the device key because its authority extends beyond merely viewing metadata. Assign a recovery owner and alternate who can follow the documented process without the original appliance. Keep a credential-to-backup-period index in the recovery vault without placing the values in ordinary documentation. Ask the alternate recovery owner to select the correct historical password using that index. A successful current-backup exercise should not substitute for testing one retained older generation.

## Verification

Use an approved recovery exercise to retrieve a designated backup and decrypt it using the vaulted credentials. Repeat for an older retained entry after a password change. Record successful decryption without copying either secret into tickets, screenshots, or diagnostic logs.

## Official reference

[Netgate — AutoConfigBackup Configuration](https://docs.netgate.com/pfsense/en/latest/backup/acb-config.html). Reviewed October 20, 2026.

## Primary reference

- Name: Netgate — AutoConfigBackup Configuration
- Authority: docs.netgate.com
- URL: https://docs.netgate.com/pfsense/en/latest/backup/acb-config.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Keep both pfSense AutoConfigBackup recovery secrets outside the firewall,” DSE Security, https://update.dsesecurity.com/updates/keep-both-pfsense-autoconfigbackup-recovery-secrets-outside-the-firewall/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.