netsudo changes firewall access. Treat it as privileged infrastructure.

• Use a dedicated pfSense automation account.
• Use SSH keys, not stored passwords.
• After initial setup, restrict the SSH key with a forced command that only runs the netsudo helper.
• Keep an unrestricted admin SSH path separate for future helper or policy updates; the restricted key is for day-to-day grants.
• Keep profile maximum durations short.
• Keep delegated --source grants behind sudo-required profiles unless the scope is low risk.
• Use --destination for narrow, task-specific access instead of broad profile-wide grants.
• Avoid broad all profiles unless they require local sudo and have a very short maximum duration.
• Keep audit logs in Wazuh or another central log collector.

Do not commit:

• pfSense passwords
• GitHub tokens
• SSH private keys
• live config files with private hostnames or policy details

The repo includes only *.example.toml configuration.

The default backend uses pfSense SSH and a helper script installed on the firewall. It does not require the unofficial pfSense REST API package. A REST backend may be added later, but should remain optional.

The tool is intended to create temporary, auditable exceptions. It should not be used to bypass change control or permanently weaken segmentation.