#Plan 9 Cluster Hardening

#Auth Server Isolation

The single most important step. From the Plan 9 wiki:

"It is often a good idea to make the auth server an independent standalone box which runs nothing at all except auth services and is hardened and secured as much as possible."

"In an institution with semi-trusted users such as a university, the auth server should be in a physically separate and secure location."

The auth server manages keyfs (encrypted user accounts) and authsrv (network auth broker). If compromised, the entire authentication domain falls.

#Role Separation

Dedicate machines to roles:

1. Auth server: auth services only, no user logins, physical security, minimal listeners
2. File server: cwfs (or gefs), authenticated access only
3. CPU servers: computation, run as untrusted users via capability system
4. Terminals: user-facing, PXE boot from controlled DHCP

#/lib/ndb Hardening

• Bind each machine to its ethernet address
• Define auth server explicitly per domain
• Use /lib/ndb/common for standard port definitions only
• Lock DHCP/PXE to known MAC addresses

#Listen Services

• Disable all unnecessary listeners
• Use aux/listen1 with explicit bind addresses, not tcp!*! wildcards
• Old (pre-dp9ik) CPU listeners are disabled by default in 9front; verify
• Review /rc/bin/service/ for enabled services

#Network

• Multiple IP stacks (up to 16): /net (stack 0) and /net.alt (stack 1+)
• Use separate stacks for different security zones
• snoopy for packet monitoring (equivalent to tcpdump)

#VLAN Isolation (Mixed Network)

When running Plan 9 on the same LAN as Linux/STARGATE:

• Put Plan 9 cluster on its own VLAN
• Allow only TCP 17019 (rcpu) and TCP 567 (auth) from workstation
• Block Plan 9 from reaching other LAN services
• Tunnel drawterm through Tailscale/WireGuard for remote access
• Never expose Plan 9 ports to the internet

#Bridging to Linux

Linux supports 9P via v9fs (CONFIG_9P_FS). Use TLS-wrapped connections. Kernel module supports access=user for per-user auth.

#Drawterm

• Use ONLY the 9front fork (dp9ik + TLS)
• Verify TLS thumbprints on first connection
• Don't run from untrusted machines

#Hardening Checklist

#Auth Server

• [ ] Dedicated machine, auth services only
• [ ] Strong password (8+ chars minimum)
• [ ] secstored running for persistent key storage
• [ ] Physical access locked
• [ ] keyfs database backed up to encrypted offline storage
• [ ] dp9ik keys only, remove any p9sk1 keys

#File Server

• [ ] cwfs for production
• [ ] Patched against CVE-2024-8158
• [ ] Minimal user accounts

#CPU Servers

• [ ] Only tcp17019 (rcpu with dp9ik+TLS) listening
• [ ] Unused service scripts in /rc/bin/service/ disabled
• [ ] All services run unprivileged via capability system

#Network

• [ ] Dedicated VLAN for Plan 9 cluster
• [ ] Firewall: only 17019/567 from workstation
• [ ] Block access to other LAN services
• [ ] Remote access via Tailscale/WireGuard only
• [ ] Machines bound to MAC addresses in /lib/ndb/local
• [ ] Periodic snoopy audits

#Key References