<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta charset="utf-8" />
<meta name="generator" content="pandoc 3.10" />
<meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
<title>P4AuthCheck</title>
<style>
/* Default styles provided by pandoc.
** See https://pandoc.org/MANUAL.html#variables-for-html for config info.
*/
html {
color: #1a1a1a;
background-color: #fdfdfd;
}
body {
margin: 0 auto;
max-width: 36em;
padding-left: 50px;
padding-right: 50px;
padding-top: 50px;
padding-bottom: 50px;
hyphens: auto;
overflow-wrap: break-word;
text-rendering: optimizeLegibility;
font-kerning: normal;
}
@media (max-width: 600px) {
body {
font-size: 0.9em;
padding: 12px;
}
h1 {
font-size: 1.8em;
}
}
@media print {
html {
background-color: white;
}
body {
background-color: transparent;
color: black;
font-size: 12pt;
}
p, h2, h3 {
orphans: 3;
widows: 3;
}
h2, h3, h4 {
page-break-after: avoid;
}
}
p {
margin: 1em 0;
}
a {
color: #1a1a1a;
}
a:visited {
color: #1a1a1a;
}
img {
max-width: 100%;
}
svg {
height: auto;
max-width: 100%;
}
h1, h2, h3, h4, h5, h6 {
margin-top: 1.4em;
}
h5, h6 {
font-size: 1em;
font-style: italic;
}
h6 {
font-weight: normal;
}
ol, ul {
padding-left: 1.7em;
margin-top: 1em;
}
li > ol, li > ul {
margin-top: 0;
}
blockquote {
margin: 1em 0 1em 1.7em;
padding-left: 1em;
border-left: 2px solid #e6e6e6;
color: #606060;
}
code {
white-space: pre-wrap;
font-family: Menlo, Monaco, Consolas, 'Lucida Console', monospace;
font-size: 85%;
margin: 0;
hyphens: manual;
}
pre {
margin: 1em 0;
overflow: auto;
}
pre code {
padding: 0;
overflow: visible;
overflow-wrap: normal;
}
.sourceCode {
background-color: transparent;
overflow: visible;
}
hr {
border: none;
border-top: 1px solid #1a1a1a;
height: 1px;
margin: 1em 0;
}
table {
margin: 1em 0;
border-collapse: collapse;
width: 100%;
overflow-x: auto;
display: block;
font-variant-numeric: lining-nums tabular-nums;
}
table caption {
margin-bottom: 0.75em;
}
tbody {
margin-top: 0.5em;
border-top: 1px solid #1a1a1a;
border-bottom: 1px solid #1a1a1a;
}
th {
border-top: 1px solid #1a1a1a;
padding: 0.25em 0.5em 0.25em 0.5em;
}
td {
padding: 0.125em 0.5em 0.25em 0.5em;
}
header {
margin-bottom: 4em;
text-align: center;
}
#TOC li {
list-style: none;
}
#TOC ul {
padding-left: 1.3em;
}
#TOC > ul {
padding-left: 0;
}
#TOC a:not(:hover) {
text-decoration: none;
}
span.smallcaps{font-variant: small-caps;}
div.columns{display: flex; gap: 1.5em;}
div.column{flex: auto;}
@media screen {
div.columns{gap: min(4vw, 1.5em);}
div.column{overflow-x: auto;}
}
div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
/* The extra [class] is a hack that increases specificity enough to
override a similar rule in reveal.js */
ul.task-list[class]{list-style: none;}
ul.task-list li input[type="checkbox"] {
font-size: inherit;
width: 0.8em;
margin: 0 0.8em 0.2em -1.6em;
vertical-align: middle;
}
.display.math{display: block; text-align: center; margin: 0.5rem auto;}
/* CSS for syntax highlighting */
html { -webkit-text-size-adjust: 100%; }
pre > code.sourceCode { white-space: pre; position: relative; }
pre > code.sourceCode > span { display: inline-block; line-height: 1.25; }
pre > code.sourceCode > span:empty { height: 1.2em; }
.sourceCode { overflow: visible; }
code.sourceCode > span { color: inherit; text-decoration: inherit; }
div.sourceCode { margin: 1em 0; }
pre.sourceCode { margin: 0; }
@media screen {
div.sourceCode { overflow: auto; }
}
@media print {
pre > code.sourceCode { white-space: pre-wrap; }
pre > code.sourceCode > span { text-indent: -5em; padding-left: 5em; }
}
pre.numberSource code
{ counter-reset: source-line 0; }
pre.numberSource code > span
{ position: relative; left: -4em; counter-increment: source-line; }
pre.numberSource code > span > a:first-child::before
{ content: counter(source-line);
position: relative; left: -1em; text-align: right; vertical-align: baseline;
border: none; display: inline-block;
-webkit-touch-callout: none; -webkit-user-select: none;
-khtml-user-select: none; -moz-user-select: none;
-ms-user-select: none; user-select: none;
padding: 0 4px; width: 4em;
color: #aaaaaa;
}
pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa; padding-left: 4px; }
div.sourceCode
{ }
@media screen {
pre > code.sourceCode > span > a:first-child::before { text-decoration: underline; }
}
code span.al { color: #ff0000; font-weight: bold; } /* Alert */
code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
code span.at { color: #7d9029; } /* Attribute */
code span.bn { color: #40a070; } /* BaseN */
code span.bu { color: #008000; } /* BuiltIn */
code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */
code span.ch { color: #4070a0; } /* Char */
code span.cn { color: #880000; } /* Constant */
code span.co { color: #60a0b0; font-style: italic; } /* Comment */
code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */
code span.do { color: #ba2121; font-style: italic; } /* Documentation */
code span.dt { color: #902000; } /* DataType */
code span.dv { color: #40a070; } /* DecVal */
code span.er { color: #ff0000; font-weight: bold; } /* Error */
code span.ex { } /* Extension */
code span.fl { color: #40a070; } /* Float */
code span.fu { color: #06287e; } /* Function */
code span.im { color: #008000; font-weight: bold; } /* Import */
code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */
code span.kw { color: #007020; font-weight: bold; } /* Keyword */
code span.op { color: #666666; } /* Operator */
code span.ot { color: #007020; } /* Other */
code span.pp { color: #bc7a00; } /* Preprocessor */
code span.sc { color: #4070a0; } /* SpecialChar */
code span.ss { color: #bb6688; } /* SpecialString */
code span.st { color: #4070a0; } /* String */
code span.va { color: #19177c; } /* Variable */
code span.vs { color: #4070a0; } /* VerbatimString */
code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
</style>
<style>
:root {
color: #1f2933;
background: #eef3f6;
font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
line-height: 1.6;
}
body {
box-sizing: border-box;
max-width: 58rem;
margin: 2.5rem auto;
padding: 3rem clamp(1.5rem, 5vw, 4.5rem);
background: #ffffff;
border-top: 5px solid #4b778d;
box-shadow: 0 0.75rem 2.5rem rgb(31 41 51 / 12%);
}
h1, h2 {
color: #173f52;
line-height: 1.2;
padding-bottom: 0.5rem;
border-bottom: 1px solid #d6e1e6;
}
h1 { margin-top: 0; font-size: 2rem; }
h2 { margin-top: 2rem; font-size: 1.4rem; }
a, a:visited { color: #0d6b85; }
a:hover { color: #a74725; }
code {
padding: 0.1em 0.3em;
background: #edf2f4;
border-radius: 3px;
color: #173f52;
}
pre {
padding: 1rem 1.2rem;
overflow-x: auto;
background: #edf2f4;
border-left: 4px solid #4b778d;
border-radius: 4px;
}
pre code {
padding: 0;
background: transparent;
color: #1f2933;
}
@media (max-width: 600px) {
body { margin: 0; padding: 1.5rem; box-shadow: none; }
h1 { font-size: 1.7rem; }
}
@media print {
:root { background: #ffffff; }
body {
max-width: none;
margin: 0;
padding: 0;
border: 0;
box-shadow: none;
}
pre { white-space: pre-wrap; overflow-wrap: anywhere; }
}
</style>
</head>
<body>
<h1 id="p4authcheck-check-and-fix-your-p4as-installation">P4AuthCheck:
Check and Fix Your P4AS Installation</h1>
<p>Use <code>p4authcheck</code> on your P4 Authentication Service
(P4AS/HAS) host to check for default credentials and unsafe
service-account settings. Assessment and fix preview do not change your
installation; only <code>--fix --yes</code> applies changes.</p>
<p>This addresses the issues identified in <a
href="https://portal.perforce.com/s/article/P4-Authentication-Service-CVE-2026-109758">P4-Authentication-Service-CVE-2026-109758</a></p>
<h2 id="step-1-log-in-as-root">Step 1: Log in as root</h2>
<p>Log in to your P4AS instance as user <code>root</code>. Run all
commands below on that instance, from the <code>/root</code>
directory.</p>
<h2 id="step-2-download-and-run-p4authcheck">Step 2: Download and run
p4authcheck</h2>
<p>For a Linux AMD64 (x86-64) host:</p>
<div class="sourceCode" id="cb1"><pre class="sourceCode sh"><code class="sourceCode bash"><span id="cb1-1"><a href="#cb1-1" aria-hidden="true" tabindex="-1"></a><span class="bu">cd</span> /root</span>
<span id="cb1-2"><a href="#cb1-2" aria-hidden="true" tabindex="-1"></a><span class="fu">wget</span> https://workshop.perforce.com/downloads/guest/perforce_software/p4authcheck/bin/p4authcheck-linux-amd64</span>
<span id="cb1-3"><a href="#cb1-3" aria-hidden="true" tabindex="-1"></a><span class="fu">chmod</span> +x p4authcheck-linux-amd64</span>
<span id="cb1-4"><a href="#cb1-4" aria-hidden="true" tabindex="-1"></a><span class="ex">./p4authcheck-linux-amd64</span></span></code></pre></div>
<p>The output shows whether your installation is vulnerable and requires
fixing. A vulnerable installation is expected before remediation; if the
tool does not report a vulnerability, let the person coordinating your
remediation know. If it cannot complete the assessment, resolve the
reported error before proceeding.</p>
<p>For a Linux ARM64 host, use <code>p4authcheck-linux-arm64</code> in
place of <code>p4authcheck-linux-amd64</code> in the download URL and
all commands.</p>
<h2 id="step-3-preview-the-fix">Step 3: Preview the fix</h2>
<p>Review the proposed changes before applying them:</p>
<div class="sourceCode" id="cb2"><pre class="sourceCode sh"><code class="sourceCode bash"><span id="cb2-1"><a href="#cb2-1" aria-hidden="true" tabindex="-1"></a><span class="ex">./p4authcheck-linux-amd64</span> <span class="at">--fix</span></span></code></pre></div>
<p>This is a preview only: it does not change configuration or restart
the service.</p>
<h2 id="step-4-apply-the-fix">Step 4: Apply the fix</h2>
<p>After reviewing the preview, append <code>--yes</code> to apply the
changes:</p>
<div class="sourceCode" id="cb3"><pre class="sourceCode sh"><code class="sourceCode bash"><span id="cb3-1"><a href="#cb3-1" aria-hidden="true" tabindex="-1"></a><span class="ex">./p4authcheck-linux-amd64</span> <span class="at">--fix</span> <span class="at">--yes</span></span></code></pre></div>
<p>The tool repairs the detected configuration issues and prints a new
assessment. It may change the service account and file ownership, and it
restarts HAS when required. Plan for a brief authentication-service
interruption. A package-upgrade finding can remain until you complete
the next step.</p>
<h2 id="step-5-update-helix-auth-svc">Step 5: Update helix-auth-svc</h2>
<p>Update the <code>helix-auth-svc</code> package to version 2026.1 or
newer using the package manager appropriate for your system and your
configured Perforce repository.</p>
<p>For Debian/Ubuntu with <code>apt</code>:</p>
<div class="sourceCode" id="cb4"><pre class="sourceCode sh"><code class="sourceCode bash"><span id="cb4-1"><a href="#cb4-1" aria-hidden="true" tabindex="-1"></a><span class="ex">apt</span> update</span>
<span id="cb4-2"><a href="#cb4-2" aria-hidden="true" tabindex="-1"></a><span class="ex">apt</span> install <span class="at">--only-upgrade</span> helix-auth-svc</span></code></pre></div>
<p>For RHEL/Rocky Linux with <code>yum</code>:</p>
<div class="sourceCode" id="cb5"><pre class="sourceCode sh"><code class="sourceCode bash"><span id="cb5-1"><a href="#cb5-1" aria-hidden="true" tabindex="-1"></a><span class="ex">yum</span> update helix-auth-svc</span></code></pre></div>
<h2 id="step-6-check-again-after-the-update">Step 6: Check again after
the update</h2>
<p>A package update can reset file ownership, particularly if the
service account was changed. Run the assessment again:</p>
<div class="sourceCode" id="cb6"><pre class="sourceCode sh"><code class="sourceCode bash"><span id="cb6-1"><a href="#cb6-1" aria-hidden="true" tabindex="-1"></a><span class="ex">./p4authcheck-linux-amd64</span></span></code></pre></div>
<p>If further repairs are needed, preview and apply them:</p>
<div class="sourceCode" id="cb7"><pre class="sourceCode sh"><code class="sourceCode bash"><span id="cb7-1"><a href="#cb7-1" aria-hidden="true" tabindex="-1"></a><span class="ex">./p4authcheck-linux-amd64</span> <span class="at">--fix</span></span>
<span id="cb7-2"><a href="#cb7-2" aria-hidden="true" tabindex="-1"></a><span class="ex">./p4authcheck-linux-amd64</span> <span class="at">--fix</span> <span class="at">--yes</span></span></code></pre></div>
<p>Run <code>./p4authcheck-linux-amd64</code> once more to confirm the
findings are resolved. Investigate any remaining findings or errors
rather than assuming the repair succeeded.</p>
<h2 id="step-7-validation-after-fixing">Step 7: Validation after
fixing</h2>
<p>Ask one or more users who are configured to use SSO with P4D to log
out and log in again using their normal P4D connection. Do this from
their workstation as the affected user, not from the P4AS host as
root.</p>
<h3 id="from-the-command-line">From the command line</h3>
<p>With <code>P4PORT</code> and <code>P4USER</code> set to the user’s
normal P4D server and username, run:</p>
<div class="sourceCode" id="cb8"><pre class="sourceCode sh"><code class="sourceCode bash"><span id="cb8-1"><a href="#cb8-1" aria-hidden="true" tabindex="-1"></a><span class="ex">p4</span> logout</span>
<span id="cb8-2"><a href="#cb8-2" aria-hidden="true" tabindex="-1"></a><span class="ex">p4</span> login</span></code></pre></div>
<p>Complete the SSO sign-in in the browser, following any URL or
instructions printed by <code>p4 login</code>. Then check that a valid
login ticket was issued:</p>
<div class="sourceCode" id="cb9"><pre class="sourceCode sh"><code class="sourceCode bash"><span id="cb9-1"><a href="#cb9-1" aria-hidden="true" tabindex="-1"></a><span class="ex">p4</span> login <span class="at">-s</span></span></code></pre></div>
<h3 id="from-p4v">From P4V</h3>
<ol type="1">
<li>Open the user’s normal P4D connection in P4V.</li>
<li>Select <strong>Connection > Log Out</strong>.</li>
<li>Select <strong>Connection > Log In</strong>.</li>
<li>Complete the SSO sign-in in the browser, then return to P4V.</li>
<li>Refresh a depot or workspace view and confirm that it loads without
an authentication error.</li>
</ol>
<p>If either method fails, record the error and report it to the
administrator coordinating the remediation.</p>
</body>
</html>