pfSense XML Configuration Redactor
Redact secrets from a pfSense config.xml so you can share it with Netgate
support, a vendor, a forum or an AI tool, without handing over your passwords,
keys and network layout.
Unlike generic XML redaction, it understands pfSense structures: IPsec, OpenVPN, WireGuard, captive portal, and the package configs where credentials actually hide.
Install
pip install pfsense-redactor
Pure Python standard library, no dependencies, Python 3.9+.
If pip reports externally-managed-environment
Common on macOS and recent Linux distributions. Any of these work:
pipx install pfsense-redactor # recommended for CLI tools
python3 -m venv venv && source venv/bin/activate
pip install pfsense-redactor
pip install --user pfsense-redactor
From source
git clone https://github.com/grounzero/pfsense-redactor.git
cd pfsense-redactor
pip install -e .
Quick start
Sharing with support, keeping internal addressing readable:
pfsense-redactor config.xml redacted.xml --keep-private-ips
Removes secrets and public identifiers, leaves RFC 1918 addressing intact so whoever is helping can still follow your topology.
Sharing with a vendor, forum or AI tool, anonymising identifiers:
pfsense-redactor config.xml redacted.xml --anonymise
Replaces addresses and domains with consistent placeholders, so relationships between rules and interfaces survive while the real values do not.
Check before you commit to it:
pfsense-redactor config.xml --dry-run-verbose
Prints what would change, with samples safely masked.
Using an unusual package? Add --aggressive. Webhook tokens live in URL
paths, and paths are otherwise preserved so package feed URLs are not destroyed.
Slack, Discord and Telegram are recognised and redacted without it; anything
else needs the flag. See
security.
How well does it work?
Measured against a 46-secret canary corpus that ships with the repository:
| Tool | Caught |
|---|---|
| pfsense-redactor | 44 / 46 (45 with --redact-descriptions) |
| ForesightCyber Config Anonymizer | 17 / 46 |
| netgate-xlsx | 11 / 46 |
The corpus was built alongside this tool, which biases it. Every released version was re-run against it to measure by how much: 31 of the 46 markers were planted against gaps this tool had, and none came from outside the project. Both misses are documented rather than hidden. Run it yourself:
pfsense-redactor tests/corpus/canary-corpus.xml --stdout --aggressive \
| grep -oE 'CANARY_[A-Z0-9_]+' | sort -u
Full method, caveats and per-secret results in the benchmark.
Before you share the output
Never restore a redacted file to pfSense. Comments, CDATA and some metadata do not survive the round trip. Keep your original.
Read the run summary. It reports high-entropy values it deliberately kept, with their element paths, so you can audit them. For a second opinion from a scanner that fails differently, see verifying output.
Documentation
| Guide | Covers |
|---|---|
| CLI reference | Every flag, with examples |
| Use cases | Netgate TAC, AI tools, MSP handoff, audits, and how this relates to diag_sanitize.php |
| Allow-lists | Keep specific IPs, CIDRs and domains readable |
| Security | Threat model, what gets redacted, path safety |
| Verifying output | Checking the result, and using gitleaks alongside |
| Benchmark | Canary corpus results and known gaps |
| Examples | Before/after output, statistics, testing |
| FAQ | Common questions |
| Security remediation tracker | Status of the July 2026 review findings |
| Changelog | Release history |
Contributing
Issues and pull requests are welcome. If you find a secret that survives
redaction, that is the most valuable report there is. A minimal fragment with
the value replaced by a CANARY_* marker can go straight into the corpus so the
miss stays fixed.
Run the tests with:
pip install -e ".[dev]"
pytest
Licence
MIT. See LICENSE.
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file pfsense_redactor-1.4.0.tar.gz.
File metadata
- Download URL: pfsense_redactor-1.4.0.tar.gz
- Upload date:
- Size: 341.8 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
ac6340149a4078a6e6c4f985fbc96f2d744450f6c11281eb298ed16c91e7a62c
|
|
| MD5 |
ea65e7df526971f075f9094c25269a75
|
|
| BLAKE2b-256 |
b2524a66327a6632946484aa5390c5acfbe58d8e9826131cbffd3e8b2e41045d
|
Provenance
The following attestation bundles were made for pfsense_redactor-1.4.0.tar.gz:
Publisher:
python-publish.yml on grounzero/pfsense-redactor
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
pfsense_redactor-1.4.0.tar.gz -
Subject digest:
ac6340149a4078a6e6c4f985fbc96f2d744450f6c11281eb298ed16c91e7a62c - Sigstore transparency entry: 2382225581
- Sigstore integration time:
-
Permalink:
grounzero/pfsense-redactor@24e3924e7cfb7a03a61912345bb8aa9b92cbaca4 -
Branch / Tag:
refs/tags/1.4.0 - Owner: https://github.com/grounzero
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
python-publish.yml@24e3924e7cfb7a03a61912345bb8aa9b92cbaca4 -
Trigger Event:
release
-
Statement type:
File details
Details for the file pfsense_redactor-1.4.0-py3-none-any.whl.
File metadata
- Download URL: pfsense_redactor-1.4.0-py3-none-any.whl
- Upload date:
- Size: 81.9 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
96909e83f262f4c456c1fb51aaeabb1dc557d61db3e4616cd3f070834851603c
|
|
| MD5 |
59a131e55883715398489b2bd8c36374
|
|
| BLAKE2b-256 |
2588064790d7fbfcca9bb244c7bf4b08efecb14c9bd198ccf9fccc0640bfd8f7
|
Provenance
The following attestation bundles were made for pfsense_redactor-1.4.0-py3-none-any.whl:
Publisher:
python-publish.yml on grounzero/pfsense-redactor
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
pfsense_redactor-1.4.0-py3-none-any.whl -
Subject digest:
96909e83f262f4c456c1fb51aaeabb1dc557d61db3e4616cd3f070834851603c - Sigstore transparency entry: 2382225694
- Sigstore integration time:
-
Permalink:
grounzero/pfsense-redactor@24e3924e7cfb7a03a61912345bb8aa9b92cbaca4 -
Branch / Tag:
refs/tags/1.4.0 - Owner: https://github.com/grounzero
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
python-publish.yml@24e3924e7cfb7a03a61912345bb8aa9b92cbaca4 -
Trigger Event:
release
-
Statement type:
