Secure P4 Search

Use the information in the following sections to help mitigate P4 Search security risks and protect your organization.

Hardening checklist

Review the following settings and setup TLS before exposing P4 Search to untrusted networks.

• P4 Search Index auth-token:

  • Configurable: com.perforce.p4search.service.token

  • Recommended setting: Unique, randomly generated token to protect your master credential

• P4 Search Nonce token:

  • Configurable: com.perforce.p4search.service.nonce

  • Recommended setting: true for CSRF defense in depth

• P4 Server trusted Services:

  • Configurable: com.perforce.p4search.core.allowed

  • Recommended setting: Trusted proxy addresses

• Elasticsearch self-signed certificate:

  • Configurable: com.perforce.p4search.elastic.insecure

  • Recommended setting: false to enable certificate validation to secure the Elasticsearch connection (default is true)

• P4 Search JWT access token:

  • Configurable: com.perforce.p4search.service.access-token-ttl

  • Recommended setting: 600 seconds, restricts how long a revoked role stays usable (default is 600 seconds)

• P4 Search Protocol:

  • Configurable: com.perforce.p4search.service.protocol

  • Recommended setting: https and secure your P4 Search communications with TLS to avoid the credentials and queries going across the network in clear text