Jenkins Hardening

This project is DEPRECATED and NO LONGER SUPPORTED. If you think this should really be supported, reach out and we can discuss options.

This cookbook aims to provide a default jenkins setup that is secure. Specifically it

• installs jenkins behind nginx
• configures ssl for nginx
• configures user logins
• runs jenkins slaves on different servers

Currently this cookbook is work-in-progress and is not yet considered secure enough for production use.

Default Plugins

Default Plugins can be overridden by

default['hardening']['jenkins']['plugins']

• ant
• build-timeout
• credentials
• git-client
• [git] (https://wiki.jenkins-ci.org/display/JENKINS/Git+Plugin)
• github
• github-api
• jquery
• matrix-auth
• maven-plugin
• metrics
• rvm
• simple-theme-plugin
• swarm
• windows-slaves

Jenkins Slaves

Windows

https://wiki.jenkins-ci.org/display/JENKINS/Step+by+step+guide+to+set+up+master+and+slave+machines

Usage

This cookbook is optimized for a usage with chef-os-hardening and chef-ssh-hardening, but has no direct dependency. Therefore this cookbook is even happy without them.

Test

# Install dependencies
gem install bundler
bundle install

# Do lint checks
bundle exec rake lint

# Kitchen test
bundle exec kitchen list
bundle exec kitchen test default-ubuntu-1204

References

• Securing Jenkins

Contributing

See contributor guideline.

License and Author

• Author:: Christoph Hartmann [email protected]
• Author:: Trent Petersen [email protected]
• Author:: Deutsche Telekom AG

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.