P4AuthCheck: Check and Fix Your P4AS Installation

Use p4authcheck on your P4 Authentication Service (P4AS/HAS) host to check for default credentials and unsafe service-account settings. Assessment and fix preview do not change your installation; only --fix --yes applies changes.

This addresses the issues identified in P4-Authentication-Service-CVE-2026-109758

Step 1: Log in as root

Log in to your P4AS instance as user root. Run all commands below on that instance, from the /root directory.

Step 2: Download and run p4authcheck

For a Linux AMD64 (x86-64) host:

cd /root
wget https://workshop.perforce.com/downloads/guest/perforce_software/p4authcheck/bin/p4authcheck-linux-amd64
chmod +x p4authcheck-linux-amd64
./p4authcheck-linux-amd64

The output shows whether your installation is vulnerable and requires fixing. A vulnerable installation is expected before remediation; if the tool does not report a vulnerability, let the person coordinating your remediation know. If it cannot complete the assessment, resolve the reported error before proceeding.

For a Linux ARM64 host, use p4authcheck-linux-arm64 in place of p4authcheck-linux-amd64 in the download URL and all commands.

Step 3: Preview the fix

Review the proposed changes before applying them:

./p4authcheck-linux-amd64 --fix

This is a preview only: it does not change configuration or restart the service.

Step 4: Apply the fix

After reviewing the preview, append --yes to apply the changes:

./p4authcheck-linux-amd64 --fix --yes

The tool repairs the detected configuration issues and prints a new assessment. It may change the service account and file ownership, and it restarts HAS when required. Plan for a brief authentication-service interruption. A package-upgrade finding can remain until you complete the next step.

Step 5: Update helix-auth-svc

Update the helix-auth-svc package to version 2026.1 or newer using the package manager appropriate for your system and your configured Perforce repository.

For Debian/Ubuntu with apt:

apt update
apt install --only-upgrade helix-auth-svc

For RHEL/Rocky Linux with yum:

yum update helix-auth-svc

Step 6: Check again after the update

A package update can reset file ownership, particularly if the service account was changed. Run the assessment again:

./p4authcheck-linux-amd64

If further repairs are needed, preview and apply them:

./p4authcheck-linux-amd64 --fix
./p4authcheck-linux-amd64 --fix --yes

Run ./p4authcheck-linux-amd64 once more to confirm the findings are resolved. Investigate any remaining findings or errors rather than assuming the repair succeeded.

Step 7: Validation after fixing

Ask one or more users who are configured to use SSO with P4D to log out and log in again using their normal P4D connection. Do this from their workstation as the affected user, not from the P4AS host as root.

From the command line

With P4PORT and P4USER set to the user’s normal P4D server and username, run:

p4 logout
p4 login

Complete the SSO sign-in in the browser, following any URL or instructions printed by p4 login. Then check that a valid login ticket was issued:

p4 login -s

From P4V

  1. Open the user’s normal P4D connection in P4V.
  2. Select Connection > Log Out.
  3. Select Connection > Log In.
  4. Complete the SSO sign-in in the browser, then return to P4V.
  5. Refresh a depot or workspace view and confirm that it loads without an authentication error.

If either method fails, record the error and report it to the administrator coordinating the remediation.