# Plan 9 Cluster Hardening

## Auth Server Isolation

The single most important step. From the Plan 9 wiki:

> "It is often a good idea to make the auth server an independent standalone box which runs nothing at all except auth services and is hardened and secured as much as possible."

> "In an institution with semi-trusted users such as a university, the auth server should be in a physically separate and secure location."

The auth server manages keyfs (encrypted user accounts) and authsrv (network auth broker). If compromised, the entire authentication domain falls.

## Role Separation

Dedicate machines to roles:
1. **Auth server**: auth services only, no user logins, physical security, minimal listeners
2. **File server**: cwfs (or gefs), authenticated access only
3. **CPU servers**: computation, run as untrusted users via capability system
4. **Terminals**: user-facing, PXE boot from controlled DHCP

## /lib/ndb Hardening

- Bind each machine to its ethernet address
- Define auth server explicitly per domain
- Use /lib/ndb/common for standard port definitions only
- Lock DHCP/PXE to known MAC addresses

## Listen Services

- Disable all unnecessary listeners
- Use aux/listen1 with explicit bind addresses, not tcp!*! wildcards
- Old (pre-dp9ik) CPU listeners are disabled by default in 9front; verify
- Review /rc/bin/service/ for enabled services

## Network

- Multiple IP stacks (up to 16): /net (stack 0) and /net.alt (stack 1+)
- Use separate stacks for different security zones
- snoopy for packet monitoring (equivalent to tcpdump)

## VLAN Isolation (Mixed Network)

When running Plan 9 on the same LAN as Linux/STARGATE:
- Put Plan 9 cluster on its own VLAN
- Allow only TCP 17019 (rcpu) and TCP 567 (auth) from workstation
- Block Plan 9 from reaching other LAN services
- Tunnel drawterm through Tailscale/WireGuard for remote access
- Never expose Plan 9 ports to the internet

## Bridging to Linux

Linux supports 9P via v9fs (CONFIG_9P_FS). Use TLS-wrapped connections. Kernel module supports access=user for per-user auth.

## Drawterm

- Use ONLY the 9front fork (dp9ik + TLS)
- Verify TLS thumbprints on first connection
- Don't run from untrusted machines

## Hardening Checklist

### Auth Server
- [ ] Dedicated machine, auth services only
- [ ] Strong password (8+ chars minimum)
- [ ] secstored running for persistent key storage
- [ ] Physical access locked
- [ ] keyfs database backed up to encrypted offline storage
- [ ] dp9ik keys only, remove any p9sk1 keys

### File Server
- [ ] cwfs for production
- [ ] Patched against CVE-2024-8158
- [ ] Minimal user accounts

### CPU Servers
- [ ] Only tcp17019 (rcpu with dp9ik+TLS) listening
- [ ] Unused service scripts in /rc/bin/service/ disabled
- [ ] All services run unprivileged via capability system

### Network
- [ ] Dedicated VLAN for Plan 9 cluster
- [ ] Firewall: only 17019/567 from workstation
- [ ] Block access to other LAN services
- [ ] Remote access via Tailscale/WireGuard only
- [ ] Machines bound to MAC addresses in /lib/ndb/local
- [ ] Periodic snoopy audits

## Key References

| Title | URL |
|-------|-----|
| Expanding your Grid | https://9p.io/wiki/plan9/Expanding_your_Grid/index.html |
| Standalone CPU Server | https://9p.io/wiki/plan9/Configuring_a_Standalone_CPU_Server/index.html |
| CPU/Auth Server Howto | http://mirror.9grid.fr/mirror.9grid.fr/plan9-cpu-auth-server-howto.html |
| Plan 9 Remote CPU | https://royniang.com/cpu_auth.html |
| Cross Domain Auth | https://plan9.io/wiki/plan9/cross_domain_authentication/index.html |
| Network Config | https://9p.io/wiki/plan9/network_configuration/index.html |
| snoopy man page | http://man.cat-v.org/plan_9/8/snoopy |
| ip(3) multiple stacks | https://9p.io/magic/man2html/3/ip |
| 9front cpu-setup | http://wiki.9front.org/cpu-setup |
| aescbc key storage | https://9p.io/wiki/plan9/using_aescbc_to_store_factotum_keys/index.html |
| v9fs Linux | https://docs.kernel.org/filesystems/9p.html |
| 9P protocol | https://ericvh.github.io/9p-rfc/rfc9p2000.html |
| Plan 9 Tunneling | https://9lab.org/plan9/tunnel/ |