pfSense User Management - Local, LDAP, and RADIUS

User Manager (System > User Manager) is the centralized account management system in pfSense. It is used to create local users, define groups with specific privileges, and configure connections to external authentication servers. User accounts serve not only for web GUI access but also for VPN service authentication, Captive Portal, and SSH console access to the firewall.

Administrator Account

During pfSense installation, an admin account is created with full privileges across all system functions. This account cannot be deleted and always retains its complete privilege set.

Admin Account Security Recommendations

Warning:

Sharing the admin account among multiple administrators makes action auditing difficult. Create individual named accounts for each administrator.

Creating Local Users

The local user database is stored in the pfSense configuration (config.xml) and does not depend on external authentication servers.

User Creation Procedure

1. Navigate to System > User Manager, tab Users
2. Click Add to create a new user
3. Fill in the parameters:

4. Click Save

Account Expiration Date

The Expiration date field allows automatic account deactivation after a specified period. This is useful for:

• Temporary contractor accounts
• Time-limited accounts (interns, auditors)
• Compliance with security policies requiring periodic access revalidation

After expiration, the user will be unable to authenticate with any pfSense service that uses the local database.

Groups and Privileges

Groups aggregate users with identical access rights. Privileges are assigned at the group level and inherited by all members. Additional privileges can be assigned individually to specific users.

Built-in admins Group

pfSense includes a built-in admins group with the WebCfg - All pages privilege assigned. All users in this group receive full web interface access. The admin account is automatically included in this group.

Creating a Group

1. Navigate to System > User Manager, tab Groups
2. Click Add
3. Fill in the parameters:

4. Click Save
5. Open the group for editing
6. In the Assigned Privileges section, click Add
7. Select the required privileges
8. Click Save

Common Privilege Schemes

Principle of Least Privilege

When assigning privileges, adhere to the following guidelines:

• Each user receives only the privileges necessary for their tasks
• Privileges are assigned through groups rather than individually (except in special cases)
• Conduct regular privilege audits and remove unused assignments
• Document the justification for each privilege assignment

Authentication Servers

pfSense supports integration with external authentication servers for centralized account management.

LDAP and Active Directory

LDAP integration allows authenticating users through a corporate Active Directory or OpenLDAP directory.

LDAP Server Configuration

1. Navigate to System > User Manager, tab Authentication Servers
2. Click Add
3. Fill in the parameters:

4. Click Save

Bind Account Requirements

pfSense requires a service account (bind account) with read permissions to search the directory. Requirements for this account:

• Minimal privileges - read-only access to user and group attributes
• Password should not expire (or ensure timely rotation in pfSense)
• Account must not be locked by AD security policies

Warning:

Do not use a domain administrator as the bind account. Compromise of this account would grant an attacker excessive privileges in the domain.

RADIUS

RADIUS integration provides authentication through a centralized RADIUS server (FreeRADIUS, Microsoft NPS, Cisco ISE, etc.).

RADIUS Server Configuration

1. Navigate to System > User Manager, tab Authentication Servers
2. Click Add
3. Fill in the parameters:

4. Click Save

RADIUS Group Mapping

To assign privileges to users authenticated via RADIUS, create local groups with the Remote scope and configure the RADIUS server to return an attribute containing the group name. The group name in the RADIUS attribute must exactly match the local group name in pfSense.

Testing Authentication

After configuring an authentication server, verify the connection:

1. Navigate to Diagnostics > Authentication
2. Select the authentication server
3. Enter a username and password
4. Click Test

The result displays the authentication status and the list of groups the user belongs to. If authentication fails, check the following:

• Server network reachability (ping, traceroute)
• Bind credential correctness (for LDAP)
• Shared secret correctness (for RADIUS)
• Base DN and Authentication containers accuracy (for LDAP)

Default Authentication Source

To change the authentication source used for web interface login:

1. Navigate to System > User Manager, tab Settings
2. In the Authentication Server field, select the desired server
3. Click Save

Warning:

When switching to an external authentication server, ensure the local admin account remains functional. If the external server becomes unavailable, it will be the only way to access the system.

Console and SSH Access

SSH Access

pfSense supports SSH access for command-line administration.

1. Enable SSH: System > Advanced, tab Admin Access, section Secure Shell
2. Check Enable Secure Shell
3. Specify the SSH port (default 22)
4. Select the authentication method:

For SSH key authentication, add the public key to the Authorized keys field of the user account.

Shell Access

By default, users with SSH access receive the pfSense console menu. To grant full shell access (tcsh):

1. Assign the User - System: Shell account access privilege to the user
2. This provides full FreeBSD command-line capabilities

Warning:

Shell access provides unrestricted system modification capabilities, including direct configuration editing. Grant it only to trusted administrators.

Sudo Access

pfSense supports sudo through the sudo package:

1. Install the sudo package via System > Package Manager
2. Configure sudo rules under System > sudo
3. Define which commands are available for each user or group

Multi-Factor Authentication

pfSense supports multi-factor authentication (MFA) through integration with RADIUS servers that support TOTP/HOTP (for example, FreeRADIUS with Google Authenticator module or privacyIDEA).

MFA Workflow

1. The user enters their username and password in the pfSense login form
2. pfSense forwards the credentials to the RADIUS server
3. The RADIUS server verifies the password and validates the OTP (or accepts the OTP concatenated with the password)
4. On successful verification, RADIUS returns Access-Accept

TOTP Integration

To implement TOTP (Time-based One-Time Password):

1. Configure a RADIUS server with TOTP support
2. Add the RADIUS server to pfSense as described above
3. Configure users on the RADIUS server with TOTP secret binding
4. Users enter their password concatenated with the OTP code (the format depends on RADIUS configuration)

Troubleshooting

Cannot Log In to the Web Interface

Possible causes and resolutions:

LDAP Bind Failure

1. Check LDAP server reachability: Diagnostics > Ping or Diagnostics > Test Port
2. Verify the bind DN format (for AD: CN=user,OU=container,DC=domain,DC=com)
3. Check whether the service account is locked by AD policies
4. When using LDAPS, verify that the CA certificate is imported into pfSense
5. Use Diagnostics > Authentication for testing

LDAP/RADIUS Groups Not Mapping to Privileges

1. Create a local group with Remote scope
2. Verify that the local group name exactly matches the directory group name
3. For LDAP: check the Group member attribute setting (memberOf for AD)
4. For RADIUS: verify that the RADIUS server returns a group name attribute
5. Use Diagnostics > Authentication to check the user group list

VPN User Cannot Connect

1. Verify the account is not disabled or expired
2. Check that the account has VPN access privileges
3. For certificate-based authentication, verify certificate-to-user binding
4. Check VPN logs under Status > System Logs

Migration Notes

When migrating pfSense configuration between devices, the local user database transfers automatically as part of config.xml. Keep in mind:

• All local users, groups, and privileges are preserved in the configuration backup
• External authentication server settings (LDAP, RADIUS) are transferred, but connectivity should be verified after migration
• User SSH keys are stored in the configuration
• User certificates are transferred with the main configuration

Related Sections

• Certificate Management - creating client certificates for VPN authentication
• VPN - OpenVPN - configuring VPN with user authentication
• Firewall Rules - restricting web interface access by IP address