diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6683003fd..e3691a069 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
-## Added
+### Added
 - model for D-Link cisco like CLI (@mirackle-spb)
 - model for Ruijie Networks RGOS devices (@spike77453)
 - Add serial number collection to Opengear (@ermuller)
@@ -21,7 +21,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - model for Fibrestore (fs.com) FSOS (@tcrichton)
 - model for IP Infusion OcNOS
 
-## Changed
+### Changed
 - tp-link: fixed enable mode post login entrance (@mirackle-spb)
 - dlink: fixed prompt for other dlink switches, added additional uptime removal expressions (@mirackle-spb)
 - Collect VC info for juniper ex3400 (@ermuller)
@@ -36,10 +36,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - pfsense: exclude autogenerated firewall rule timestamps to reduce change churn from use of stuff like PFBlockerNG #2985 (@anthonysomerset)
 - ciscosmb: ignore "Please change the password" hint when doing backup. (@sharteeya)
 - dlinknextgen removes user and snmp-server secrets (@tcrichton)
+- dnos: hide secrets in "ospf message-digest-key", "authentication-type" and "bsd-username" (@rybnico)
 - junos: Replace dynamic value in VMX-BANDWIDTH with count, hide ssh keys
 
-
-## Fixed
+### Fixed
 - fixed empty lines for ZyXEL GS1900 switches (@jluebbe)
 - fixed prompt for Watchguard FirewareOS not matching the regex when the node is non-master (@netdiver)
 - defined 'psych' runtime dependency to resolve 'unsafe_load' error during startup (@MattKobayashi)
@@ -64,13 +64,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [0.29.1 - 2023-04-24]
 
-## Added
+### Added
 
-## Changed
+### Changed
 
 - Ensure Docker builds are only pushed to registry on `master` (@aschaber1)
 
-## Fixed
+### Fixed
 
 - #2749: fix issues with `cut_both`
 
diff --git a/lib/oxidized/model/dnos.rb b/lib/oxidized/model/dnos.rb
index 19d749d53..c71386717 100644
--- a/lib/oxidized/model/dnos.rb
+++ b/lib/oxidized/model/dnos.rb
@@ -16,6 +16,9 @@ class DNOS < Oxidized::Model
     cfg.gsub! /secret (\d+) (\S+).*/, '<secret hidden>'
     cfg.gsub! /password (\d+) (\S+).*/, '<secret hidden>'
     cfg.gsub! /^(tacacs-server key \d+) (\S+).*/, '\\1 <secret hidden>'
+    cfg.gsub! /(ip ospf message-digest-key \d \S+ \d).*/, '\\1 <secret hidden>'
+    cfg.gsub! /(authentication-type).*/, '\\1 <secret hidden>'
+    cfg.gsub! /^(bsd-username \S+ secret).*/, '\\1 <secret hidden>'
     cfg
   end