Helix Core is now P4. Product user interfaces will be updated soon. Learn more >>

P4 Server Administration Documentation | 2026.1

# Security hardening

Before you install P4 Server, review the following security hardening steps so you can plan for a secure deployment. A default installation is functional but not hardened, and leaving it unchanged can expose your data and infrastructure.

You should complete the following essential security tasks as part of your initial deployment. To learn more, see Important security update: Secure by default.

## Use ticket-based authentication

By default, P4 Server can allow password-based logins without enforced expiration. You should enable ticket-based authentication to ensure credentials expire and must be renewed.

Consider setting the server security level to `4` or higher.

This configuration:

- Requires users to authenticate using tickets.

- Enforces stronger password and authentication rules.

- Is especially important in multi-server and replicated environments.

For complete information about security, see Secure the server, including Important security update: Secure by default.

## Restrict user creation and password management

Uncontrolled user creation is a common source of security issues in freshly installed servers.

### After installation:

- Ensure that only super users can create new users.

- Prevent automatic user creation on first login.

- Require users to reset their password when a super user assigns an initial password.

### These settings help:

- Prevent anonymous or accidental account creation.

- Ensure all user accounts start with known, strong credentials.

To set (or reset) a user’s password, either:

- Use `p4 passwd`username`` (as a P4 Server superuser), and enter the new password for the user.
- Invoke `p4 user -f `username`` (also a superuser) and enter the new password into the user specification form.

### Assign strong passwords to privileged accounts

The security of the entire server depends on the super user account(s).

Immediately after installation:

- Set a strong, unique password for all super users.

- Avoid sharing privileged credentials.

- Use individual named accounts for administrative access.

Before tightening password policies, ensure at least one super user account is fully functional to avoid locking yourself out.

## Protect sensitive server information

Several commands display server and user information that may be useful to attackers if left unrestricted.

Enable settings that:

- Hide sensitive details from unauthenticated users.

- Limit the information returned by `p4 info`.

- Prevent exposure of internal configuration values used by scripts or integrations.

This reduces the amount of server metadata visible without proper authorization.

## Configure protections early

The protections table controls what users can do on the server. Before allowing general access:

- Verify that a super user exists and has a strong password.

- Review the default protections table.

- Remove or restrict overly broad permissions.

Do not rely on default protections for production systems. A minimal, explicit protections table is safer and easier to audit over time.

## Secure network access

P4 Server listens on a network port and should not be exposed unnecessarily.

Best practices include:

- Running the server behind a firewall.

- Allowing connections only from trusted networks.

- Avoiding direct internet exposure unless absolutely required.

If remote access is necessary, use encrypted connections and strong authentication controls.

## Use encrypted connections (SSL/TLS)

If clients connect over untrusted networks, configure SSL/TLS for P4 Server connections.

Encrypted connections:

- Protect credentials and data in transit.

- Prevent session interception.

- Are strongly recommended for all non-local deployments.

This is especially important for cloud-hosted and geographically distributed servers.

## Review security configurables regularly

P4 Server provides many configurables that affect authentication, authorization, and information disclosure.

After installation:

- Review the recommended security configurables. See Important security update: Secure by default.

- Verify they match your organization’s security requirements.

- Revisit them periodically as your deployment grows.

Your search for returned results