Config backup content — what is in the XML, what is not, and what to redact

The backup file the operator downloads is one XML document. It is also a misleadingly compact artefact: a 400 KB file can hold an entire production firewall’s personality, including secrets the operator forgot were there. To use the backup well, the operator must know what is in it, what is not in it, and what must be redacted before the file leaves the building.

This lesson walks through the major sections, lists the things that look like configuration but live elsewhere on disk, and covers the redaction discipline that keeps the operator out of incident reports.

What is in /conf/config.xml

The XML document is a tree. The major top-level sections the operator will encounter during a restore:

The XML is read at boot, parsed into PHP data structures, and used to regenerate the running configuration: /etc/pf.conf, /etc/rc.conf, /var/unbound/unbound.conf, /usr/local/etc/ipsec.conf, and so on. The XML is the source of truth; the generated files are derived.

What is not in the backup

The XML is comprehensive, but it is not the entire firewall state. The items below live on disk, not in XML, and are not part of a standard backup:

• DHCP leases (/var/dhcpd/var/db/dhcpd.leases). Active leases, expiry times, reservation state.
• Certificate private keys for the system CA (technically in <cert>, but with caveats — see warning below).
• RRD round-robin databases (/var/rrd/*.rrd). Historical performance data.
• Log files (/var/log/*). Firewall logs, system logs, authentication logs.
• The firmware itself. The backup is a configuration; it does not include the kernel or the packages.
• The recoverpackage data. Only present in “this firewall” backups.
• SSH host keys. /etc/ssh/ssh_host_*_key. A restored configuration will not have the same SSH fingerprint as the original host.
• WireGuard interface private keys (where the operator has chosen to keep them out of XML, which is supported).

A restore brings the configuration back. It does not bring the lease database, the historical graphs, the log archives, or the SSH fingerprint back. A “full rebuild” on identical hardware would require booting the firmware installer, restoring the configuration, and accepting that the new appliance will start with empty RRDs and a fresh lease database.

Redacting a backup before sharing

There are four scenarios where the operator must share a backup:

1. A vendor support request. The vendor needs the configuration to reproduce an issue.
2. A community forum post. The operator wants help diagnosing a configuration-level problem.
3. A documentation screenshot. The operator is writing a runbook and needs realistic content.
4. A compliance audit. The auditor wants to see the configuration.

In every case, the same redaction procedure:

1. Copy the XML to a working file.
2. Remove the \<cert\> section (replace with \<cert\>\</cert\>).
3. Remove the \<IPsec\>\<phase1\>...\<pre-shared-key\> entries (search for pre-shared-key).
4. Remove \<auth\>\<server\>...\<secret\> entries (search for secret).
5. Replace real IP addresses with documentation prefixes (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24).
6. Replace real hostnames with placeholder names.
7. Sign the redacted file with sha256sum and attach the hash to the sharing message.

The redacted file is a representation, not a restore. It is suitable for diagnosis and discussion; it is not suitable for a restore.

$ xmllint --format /conf/backup/config-2026-08-15-0317.xml | head -40

<?xml version="1.0"?>
<opnsense>
<version>25.7</version>
<theme>opnsense</theme>
<system>
  <hostname>fw-edge-01</hostname>
  <domain>example.net</domain>
  <dnsserver>9.9.9.10</dnsserver>
  <dnsserver>149.112.112.10</dnsserver>
  <timeservers>0.opnsense.pool.ntp.org</timeservers>
  ...
</system>
<interfaces>
  <wan>
    <if>igb0</if>
    <enable>1</enable>
    <ipaddr>dhcp</ipaddr>
    <blockbogons>1</blockbogons>
  </wan>
  <lan>
    <if>igb1</if>
    <enable>1</enable>
    <ipaddr>192.0.2.1</ipaddr>
    <subnet>24</subnet>
  </lan>
  ...
</interfaces>
...
</opnsense>

Summary

• The XML is the source of truth; the running config files are derived from it.
• The XML holds credentials. Treat it as a credential.
• DHCP leases, RRDs, logs, SSH host keys, and the firmware itself are not in the backup.
• A redacted backup is for diagnosis. A full backup is for restore.
• No change without a backup, no backup without a redaction plan.