Managing the System Configuration

TrueNAS allows users to manage the system configuration by uploading or downloading configurations, or by resetting the system to the default configuration.

The Manage Configuration option on the System > General Settings screen provides three options:

• Download File that downloads your system configuration settings to a file on your system.
• Upload File that allows you to upload a replacement configuration file.
• Reset to Defaults that resets system configuration settings back to factory settings.

The Download File option downloads your TrueNAS current configuration to the local machine.

In TrueNAS 25.04 (and later), users must log in as a system administrator with full administrative access to upload or download a system configuration file. Other users, including restricted admin accounts such as a shares administrator, cannot perform database operations. See Using Administrator Logins for more information on admin account types.

When you download the configuration (config) file, you have the option to include the secret seed in the config file. Select Export Password Secret Seed to download this file. Downloading the config file and the secret seed file allows you to restore the system to a different operating system device where the secret seed is not already present.

Why should I save the secret seed?

The secret seed is used to decrypt encrypted fields in the TrueNAS configuration database. Various fields are encrypted because they might contain sensitive information such as cryptographic certificates, passwords (not user login passwords), or weak hashing algorithms (for example, NT hashes of SMB users).

When a config file is restored without the secret seed, encrypted fields are set to empty values. This means various services can break due to the missing information. Examples are SMB via local accounts and apps. Always select the option to save the secret seed when downloading the system config file!

Note, the secret seed does not store local users passwords in any form, only a hash of the password sufficient for authentication. Hashed passwords are not encrypted.

What happens if I do not save the secret seed? You might be prompted to enter a default password or reset the password. The UI should allow users to log into the system with their current password but might be prompted to enter a new password. Users can connect a keyboard and monitor to the system and enter a new password if they cannot log into the web UI or reset the current password.

Is there a default password for the system? Enterprise users are issued a password to enter if prompted for such a password after the system resets. Community users are not issued a default password and the system does not generate a default password for this purpose. If you cannot log into the UI with the current administration password, connect a keyboard and monitor to the system server to reset the password.

After logging into the system, recheck all system settings to verify the configurations are correct, and then test to verify the system is working as desired. When complete and the system is operating per the desired configuration, download and save the system configuration with the secret seed option selected and keep it in a secure location.

It is a best practice to always save the secret seed with the system configuration file after making system configuration changes to have a current backup copy to use should the need arise.

Physically secure the config file with the secret seed, and any encryption key files to decrypt encrypted datasets or pools.

We recommend backing up the system configuration regularly. Doing so preserves settings when migrating, restoring, or fixing the system if it runs into any issues. Save the configuration file each time the system configuration changes.

To download the configuration file:

Go to System > General Settings and click on Manage Configuration. Select Download File.

The Save Configuration dialog opens.

Select Export Password Secret Seed and then click Save. The system downloads the system configuration. Keep this file in a safe location on your network where files are regularly backed up.

The Upload File option gives users the ability to replace the current system configuration with any previously saved TrueNAS configuration file.

When migrating from a FreeBSD-based releases to a Linux-based release, the new administration user login credentials (name and password) are deleted and replaced with the FreeBSD-based root user and password in the uploaded configuration file. Log into the UI with the original root user credentials, then recreate an administration user and password.

To security-harden your system, do not use the trunas_admin user or admin, choose a unique username and password that cannot be easily guessed. Disable the root user login password as the final step.

If you do not save the secret seed downloading the system config file, various services can break due to missing information. Without the secret seed, encrypted fields are set to empty values. For example, SMB via local accounts and apps. Always select the option to save the secret seed when downloading the system config file!

TrueNAS Enterprise

Enterprise High Availability (HA) systems should never reset their system configuration to defaults. Contact TrueNAS Enterprise Support if a system configuration reset is required.

TrueNAS Enterprise Support

Customers who purchase TrueNAS hardware or that want additional support must have a support contract to use TrueNAS Support Services. The TrueNAS Community forums provides free support for users without a TrueNAS Support contract.

TrueNAS Customer Support
Support Portal	https://support.ixsystems.com
Email	support@ixsystems.com
Telephone and Other Resources	https://www.ixsystems.com/support/

Save the current system configuration with the Download File option before resetting the configuration to default settings! If you do not save the system configuration before resetting it, you could lose data that was not backed up, and you cannot revert to the previous configuration.

The Reset to Defaults option resets the system configuration to factory settings. After the configuration resets, the system restarts and users must set a new login password.

TrueNAS does not automatically back up the system configuration file to the system dataset.

Users who want to schedule an automatic backup of the system configuration file should:

1. Set up TrueCommand.
2. Add their TrueNAS system.
3. Create and schedule the configuration file backup.

Users can manually back up the TrueNAS config file by downloading and saving the file to a location that is automatically backed up.