system:user_password: compare password hash and update if needed
pf:save: run pfctl silently