# 9front Security

## dp9ik Authentication Protocol

Replaced p9sk1 (DES-based). Old CPU listeners disabled by default.

Configuration:
- `auth/wrkey` prompts for authid, authdom, secstore key, password
- Keys loaded: `echo 'key proto=dp9ik dom=YOURDOMAIN user=USER !password=PASS' >/mnt/factotum/ctl`
- CPU listener: `aux/listen1 -t 'tcp!*!rcpu' /rc/bin/service/tcp17019`

## TLS-Based Connections

Modern 9front uses TLS for cpu connections via rcpu (replacing SSL-based ncpu). 9front drawterm supports dp9ik and TLS-based rcpu.

## gefs Filesystem

Copy-on-write with atomic commits. Crash-safe (at most 5 seconds of data loss). Block pointers include hashes for corruption detection. Still maturing; cwfs remains the proven choice for production.

## CVE-2024-8158

lib9p authentication bypass. Attacker with valid credentials could impersonate any filesystem user because lib9p didn't verify uname in Tauth/Tattach matched client UID. Affected hjfs. cwfs and gefs not affected. Fixed in commit 9645ae07eb66a59015e3e118d0024790c37400da.

## Key References

| Title | URL |
|-------|-----|
| 9front FQA 7 (System Management) | https://fqa.9front.org/fqa7.html |
| 9front FQA 8 (Using 9front) | https://fqa.9front.org/fqa8.html |
| 9front FQA 6 (Networking) | http://fqa.9front.org/fqa6.html |
| Using p9sk1 in modern 9front | https://seh.dev/p9sk1/ |
| 9front factotum man page | https://man.9front.org/4/factotum |
| 9front drawterm | https://drawterm.9front.org/ |
| gefs design | https://orib.dev/gefs.html |
| CVE-2024-8158 | https://nvd.nist.gov/vuln/detail/CVE-2024-8158 |