#9front Security

#dp9ik Authentication Protocol

Replaced p9sk1 (DES-based). Old CPU listeners disabled by default.

Configuration:

• auth/wrkey prompts for authid, authdom, secstore key, password
• Keys loaded: echo 'key proto=dp9ik dom=YOURDOMAIN user=USER !password=PASS' >/mnt/factotum/ctl
• CPU listener: aux/listen1 -t 'tcp!*!rcpu' /rc/bin/service/tcp17019

#TLS-Based Connections

Modern 9front uses TLS for cpu connections via rcpu (replacing SSL-based ncpu). 9front drawterm supports dp9ik and TLS-based rcpu.

#gefs Filesystem

Copy-on-write with atomic commits. Crash-safe (at most 5 seconds of data loss). Block pointers include hashes for corruption detection. Still maturing; cwfs remains the proven choice for production.

#CVE-2024-8158

lib9p authentication bypass. Attacker with valid credentials could impersonate any filesystem user because lib9p didn't verify uname in Tauth/Tattach matched client UID. Affected hjfs. cwfs and gefs not affected. Fixed in commit 9645ae07eb66a59015e3e118d0024790c37400da.

#Key References