Helix Core is now P4. Product user interfaces will be updated soon. Learn more >>

P4 Server Administration Documentation | 2025.2

# Protections and passwords

Until you define a P4 Server superuser, every user is a superuser and can run any P4 Server command on any file. After you start a new Perforce service, use the `p4 protect` command as soon as possible to define a P4 Server superuser. To learn more, also see Access authorization.

Without passwords, any user is able to impersonate any other P4 Server user, either with the `-u` flag or by setting `P4USER` to an existing P4 Server user name. Use of P4 Server passwords prevents such impersonation. See Passwords in the P4 CLI Documentation.

To set (or reset) a user’s password, either

- use `p4 passwd `username`` (as a P4 Server superuser), and enter the new password for the user, or
- invoke `p4 user -f `username`` (also a superuser) and enter the new password into the user specification form.

The security-conscious P4 Server superuser also uses `p4 protect` to ensure that no access higher than `list` is granted to unprivileged users, p4 configure to set the `security` level to a level that requires that all users have strong passwords, and `p4 group` to assign all users to groups (and, optionally, to require regular changes of passwords for users on a per-group basis, to set a minimum required password length for all users on the site, and to lock out users for predefined amounts of time after repeated failed login attempts).

An alternate way to reduce security risk during initial setup or during a maintenance interval is to start the P4 Server using `localhost:`port`` syntax. For example:

     p4d localhost:2019

This forces the server to ignore non-local connection requests.

For complete information about security, see Secure the server, including Configurables for security.

Your search for returned results