Java Jenkins 使用什么密码加密？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/25547381/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
What password encryption Jenkins is using?
提问by Fran b
I am modifying an xml of a Jenkins job. There is a field which is a password. When I get the xml, where it was the raw password now there is a hash.
我正在修改 Jenkins 作业的 xml。有一个字段是密码。当我得到 xml 时，它是原始密码，现在有一个哈希值。
What I need is to know how to create this hash from the raw password value.
我需要的是知道如何从原始密码值创建这个哈希。
<scm class="com.deluan.jenkins.plugins.rtc.JazzSCM">
<username>user</username>
<password>zlvnUMF1/hXwe3PLoitMpQ6BuQHBJ1FnpH7vmMmQ2qk=</password>
</scm>
I have been reading Jenkins source codeand I think the class HudsonPrivateSecurityRealm.java is involved but I am not sure about the salt parameter.
我一直在阅读 Jenkins源代码，我认为涉及 HudsonPrivateSecurityRealm.java 类，但我不确定 salt 参数。
PS: This is not for the Jenkins password is for a plugin which in the job configuration it has a password field.
PS：这不是针对 Jenkins 密码的，而是针对在作业配置中具有密码字段的插件。
回答by tartakynov
In fact, it's not a hash but rather an encrypted password. I guess encryption keys are stored in the master node. Actually, you can decrypt the password by executing following groovy script on master's script console
事实上，它不是散列而是加密的密码。我猜加密密钥存储在主节点中。实际上，您可以通过在 master 的脚本控制台上执行以下 groovy 脚本来解密密码
import hudson.util.Secret
def secret = Secret.fromString("zlvnUMF1/hXwe3PLoitMpQ6BuQHBJ1FnpH7vmMmQ2qk=")
println(secret.getPlainText())
and if you want to encrypt the password, then
如果你想加密密码，那么
import hudson.util.Secret
def secret = Secret.fromString("your password")
println(secret.getEncryptedValue())
A password encrypted on a computer can be decrypted only on that particular computer since keys are randomly generated and obviously on different machines the keys are different.
在计算机上加密的密码只能在该特定计算机上解密，因为密钥是随机生成的，显然在不同的机器上，密钥是不同的。
Check out core/src/main/java/hudson/util/Secret.javafor more details
回答by CSchulz
Another possibility would be to execute a Groovy script via Jenkins Groovy console (you can reach it via JENKINS_URL/script):
另一种可能性是通过 Jenkins Groovy 控制台执行 Groovy 脚本（您可以通过JENKINS_URL/script访问它）：
println(hudson.util.Secret.decrypt("zlvnUMF1/hXwe3PLoitMpQ6BuQHBJ1FnpH7vmMmQ2qk="))
Some other ways would be possible with python:
使用 python 还可以使用其他一些方法：
https://github.com/tweksteen/jenkins-decrypt
https://gist.github.com/menski/8f9980999ed43246b9b2
https://github.com/tweksteen/jenkins-decrypt
https://gist.github.com/menski/8f9980999ed43246b9b2
回答by kenorb
Jenkins uses AES-128-ECBfor all its encryptions. It basically uses the master.keyfile to encrypt the key stored in hudson.util.Secretfile. This key is then used to encrypt the password in credentials.xml.
Jenkins 使用AES-128-ECB进行所有加密。它基本上使用master.key文件来加密存储在hudson.util.Secret文件中的密钥。然后使用此密钥对 中的密码进行加密credentials.xml。
So to decrypt Jenkins password, you need basically access to hudson.util.Secretand master.keyfiles. You can check exactly how Jenkins encrypts the password by looking into hudson.utils.Secretclass and its fromStringmethod. Basically the password is concatenated with a magic before being encrypted using KEY.
因此，要解密 Jenkins 密码，您基本上需要访问hudson.util.Secret和master.key文件。您可以通过查看hudson.utils.Secret类及其fromString方法来准确检查 Jenkins 如何加密密码。基本上，密码在使用 KEY 加密之前与魔法连接。
For more details, please check: Credentials storage in Jenkins.
更多详细信息，请查看：Jenkins 中的凭证存储。
To decrypt the password, follow these steps:
要解密密码，请按照下列步骤操作：
- While logged in as admin in Jenkins, go to:
/scriptpage. Run the following command:
println(hudson.util.Secret.decrypt("{XXX=}"))or:
println(hudson.util.Secret.fromString("{XXX=}").getPlainText())where
{XXX=}is your encrypted password. This will print the plain password.To do opposite, run:
println(hudson.util.Secret.fromString("some_text").getEncryptedValue())
- 在 Jenkins 中以管理员身份登录时，转到：
/script页面。 运行以下命令：
println(hudson.util.Secret.decrypt("{XXX=}"))或者：
println(hudson.util.Secret.fromString("{XXX=}").getPlainText()){XXX=}你的加密密码在哪里。这将打印纯密码。要进行相反的操作，请运行：
println(hudson.util.Secret.fromString("some_text").getEncryptedValue())
Source: gist at tuxfight3r/jenkins-decrypt.groovy.
资料来源：要点tuxfight3r/jenkins-decrypt.groovy。
Alternatively check the following scripts: tweksteen/jenkins-decrypt,
menski/jenkins-decrypt.py.
或者检查以下脚本：tweksteen/jenkins-decrypt,
menski/jenkins-decrypt.py.
