# P4AuthCheck: Check and Fix Your P4AS Installation

Use `p4authcheck` on your P4 Authentication Service (P4AS/HAS) host to check
for default credentials and unsafe service-account settings. Assessment and
fix preview do not change your installation; only `--fix --yes` applies changes.

This addresses the issues identified in [P4-Authentication-Service-CVE-2026-109758](https://portal.perforce.com/s/article/P4-Authentication-Service-CVE-2026-109758)

## Step 1: Log in as root

Log in to your P4AS instance as user `root`. Run all commands below on that
instance, from the `/root` directory.

## Step 2: Download and run p4authcheck

For a Linux AMD64 (x86-64) host:

```sh
cd /root
wget https://workshop.perforce.com/downloads/guest/perforce_software/p4authcheck/bin/p4authcheck-linux-amd64
chmod +x p4authcheck-linux-amd64
./p4authcheck-linux-amd64
```

The output shows whether your installation is vulnerable and requires fixing.
A vulnerable installation is expected before remediation; if the tool does not
report a vulnerability, let the person coordinating your remediation know.
If it cannot complete the assessment, resolve the reported error before proceeding.

For a Linux ARM64 host, use `p4authcheck-linux-arm64` in place of
`p4authcheck-linux-amd64` in the download URL and all commands.

## Step 3: Preview the fix

Review the proposed changes before applying them:

```sh
./p4authcheck-linux-amd64 --fix
```

This is a preview only: it does not change configuration or restart the service.

## Step 4: Apply the fix

After reviewing the preview, append `--yes` to apply the changes:

```sh
./p4authcheck-linux-amd64 --fix --yes
```

The tool repairs the detected configuration issues and prints a new assessment.
It may change the service account and file ownership, and it restarts HAS when
required. Plan for a brief authentication-service interruption.
A package-upgrade finding can remain until you complete the next step.

## Step 5: Update helix-auth-svc

Update the `helix-auth-svc` package to version 2026.1 or newer using the package
manager appropriate for your system and your configured Perforce repository.

For Debian/Ubuntu with `apt`:

```sh
apt update
apt install --only-upgrade helix-auth-svc
```

For RHEL/Rocky Linux with `yum`:

```sh
yum update helix-auth-svc
```

## Step 6: Check again after the update

A package update can reset file ownership, particularly if the service account
was changed. Run the assessment again:

```sh
./p4authcheck-linux-amd64
```

If further repairs are needed, preview and apply them:

```sh
./p4authcheck-linux-amd64 --fix
./p4authcheck-linux-amd64 --fix --yes
```

Run `./p4authcheck-linux-amd64` once more to confirm the findings are resolved.
Investigate any remaining findings or errors rather than assuming the repair
succeeded.

## Step 7: Validation after fixing

Ask one or more users who are configured to use SSO with P4D to log out and
log in again using their normal P4D connection. Do this from their workstation
as the affected user, not from the P4AS host as root.

### From the command line

With `P4PORT` and `P4USER` set to the user's normal P4D server and username, run:

```sh
p4 logout
p4 login
```

Complete the SSO sign-in in the browser, following any URL or instructions
printed by `p4 login`. Then check that a valid login ticket was issued:

```sh
p4 login -s
```

### From P4V

1. Open the user's normal P4D connection in P4V.
2. Select **Connection > Log Out**.
3. Select **Connection > Log In**.
4. Complete the SSO sign-in in the browser, then return to P4V.
5. Refresh a depot or workspace view and confirm that it loads without an
   authentication error.

If either method fails, record the error and report it to the administrator
coordinating the remediation.