Runbook: Respond to Compromised Credentials
1 · Prerequisites
Confirm every item is in place before any state change.
- Confirmed or suspected compromise of an OPNsense credential
- Security team notification
- Access to the firewall and the upstream identity provider
- Maintenance window scheduled for the containment and remediation
2 · Pre-checks
Read-only diagnostic commands. If any of these don't match expected output, stop and investigate further.
- · Confirm the compromise and identify the credential that was compromised
- · Identify the IP and the user agent that used the compromised credential
- · Capture the current configuration as a safety net
- · Engage the security team before changing any credentials
3 · Procedure
Execute each step in order. Verify the expected output of a step before moving to the next.
- 1From the GUI, navigate to System > Access > Users and disable the compromised user account
- 2If the compromised account is the local admin, change the admin password from the console immediately
- 3Audit the System > Log Files > Admin log for the IP and the user agent associated with the compromise
- 4Audit the firewall log for any rules that were created or modified by the compromised account
- 5If the compromised account is a service account, rotate the API token and the certificate if applicable
- 6If the compromised account is tied to an SSO provider, revoke the SSO session and force a re-authentication
- 7Change the password for any other account that shares the same password or the same password pattern
- 8Capture the latest configuration backup and store it in an offline location for forensics
- 9Audit the change record for any changes that were made by the compromised account
- 10Re-enable the user account only after the credential has been rotated and the security team has signed off
4 · Verification
Confirm the procedure actually fixed the problem.
- ✓The compromised credential is disabled and the new credential is in place
- ✓The admin log shows no further activity from the compromised credential
- ✓No unauthorized changes are found in the firewall log or the change record
- ✓The security team has confirmed the incident is contained
5 · Rollback
If verification fails, undo the procedure in reverse order.
- ↶If the credential rotation causes a service outage, restore the previous configuration from the backup
- ↶If the new credential is compromised, repeat the procedure with a stronger credential
- ↶If the audit reveals that the compromise is broader than the firewall, escalate to the security team
6 · Escalation
When the runbook isn't enough, contact:
- · Engage the security team immediately if the compromise is confirmed
- · Engage the legal team if the compromise involves regulated data
- · Engage the platform team if the compromised account is a service account used by an automation tool
Purpose
Contain a confirmed or suspected compromise of an OPNsense credential, rotate the credential, audit the changes that were made under the compromised credential, and return the appliance to a trusted state.
When to use this runbook
Use this runbook when a credential is suspected or confirmed to be compromised, when an unauthorized change is detected in the firewall log, or when the security team requests a credential rotation.
Pre-checks
Before starting the procedure, confirm the prerequisites and pre-checks are met. The structured lists are rendered from the frontmatter by the page layout.
Procedure
Follow the steps from the frontmatter procedure steps. The page layout renders the steps as a checklist with copy-to-clipboard affordances.
Verification
After the procedure, the structured verification items from the frontmatter are rendered as a checklist.
Rollback
If the procedure fails or makes things worse, follow the structured rollback steps from the frontmatter.
Escalation
The structured escalation path is rendered from the frontmatter. Use it if the operator cannot complete the procedure safely.