Jenkins Hardening

This project is DEPRECATED and NO LONGER SUPPORTED. If you think this should really be supported, reach out and we can discuss options.

This cookbook aims to provide a default jenkins setup that is secure. Specifically it

installs jenkins behind nginx
configures ssl for nginx
configures user logins
runs jenkins slaves on different servers

Currently this cookbook is work-in-progress and is not yet considered secure enough for production use.

Default Plugins

Default Plugins can be overridden by

default['hardening']['jenkins']['plugins']

ant
build-timeout
credentials
git-client
[git] (https://wiki.jenkins-ci.org/display/JENKINS/Git+Plugin)
github
github-api
jquery
matrix-auth
maven-plugin
metrics
rvm
simple-theme-plugin
swarm
windows-slaves

Jenkins Slaves

Windows

https://wiki.jenkins-ci.org/display/JENKINS/Step+by+step+guide+to+set+up+master+and+slave+machines

Usage

This cookbook is optimized for a usage with chef-os-hardening and chef-ssh-hardening, but has no direct dependency. Therefore this cookbook is even happy without them.

Test

# Install dependencies
gem install bundler
bundle install

# Do lint checks
bundle exec rake lint

# Kitchen test
bundle exec kitchen list
bundle exec kitchen test default-ubuntu-1204

References

Securing Jenkins

Contributing

See contributor guideline.

License and Author

Author:: Christoph Hartmann chris@lollyrock.com
Author:: Trent Petersen trent.petersen@convergint.com
Author:: Deutsche Telekom AG

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

dev-sec/chef-jenkins-hardening