git Jenkins 配置和安全问题

Jenkins configuration and security issues

提问by LP13

This is the first time I am using Jenkins and I have gone through several online articles but couldn't find satisfactory answers. We have .Net project, and we are using private GitHub repository. Now I am trying to build CI server with Jenkins. Idea is to whenever developer push the code to GitHub we want to build the project on CI server. I have already installed Jenkins (v 1.646) and GitHub,Git and MSBuild Plugin on CI server. After working with Jenkins for last several hours i have now have several questions.

这是我第一次使用 Jenkins，我浏览了几篇在线文章，但找不到满意的答案。我们有 .Net 项目，我们正在使用私有 GitHub 存储库。现在我正在尝试用 Jenkins 构建 CI 服务器。想法是每当开发人员将代码推送到 GitHub 时，我们都希望在 CI 服务器上构建项目。我已经在 CI 服务器上安装了 Jenkins (v 1.646) 和 GitHub、Git 和 MSBuild 插件。在与 Jenkins 一起工作了几个小时之后，我现在有几个问题。

1> By default Jenkins runs on port 8080. But for continuous integration to work Jenkins must receive notification from GitHub. The port 8080 is by default blocked from the outside world, on CI server port 80 is open. I updated httpport in Jenkins.xml file so Jenkins is running on port 80.
I can access Jenkins from public internet and the web hook url is now http://ipaddress/github-webhookbut this opens a big security hole because now anyone can access Jenskins. To solve this issue I have configured global security -> Project-based Matrix Authorization Strategy. So now only I can login and manage the projects. However any person can still type the IP address, land on Jenkins page and Create new user account. Ofcource that user cannot access anything but still it creates a new user in Jenkins's database So is there a way to run Jenkins management on port 8080 as usual, but receive notification on port 80

1> 默认情况下，Jenkins 运行在 8080 端口。但是为了持续集成工作，Jenkins 必须收到来自 GitHub 的通知。默认情况下，端口 8080 与外界隔绝，在 CI 服务器上，端口 80 是开放的。我更新了 Jenkins.xml 文件中的 httpport，因此 Jenkins 在端口 80 上运行。
我可以从公共互联网访问 Jenkins，并且 web hook url 现在是http://ipaddress/github-webhook但这打开了一个很大的安全漏洞，因为现在任何人都可以访问 Jenskins。为了解决这个问题，我配置了全局安全 -> 基于项目的矩阵授权策略。所以现在只有我可以登录和管理项目。然而，任何人仍然可以输入 IP 地址，登陆 Jenkins 页面并创建新用户帐户。Ofcource 该用户无法访问任何内容，但它仍然在 Jenkins 的数据库中创建一个新用户 所以有没有办法像往常一样在端口 8080 上运行 Jenkins 管理，但在端口 80 上收到通知

2> On Jenkins's System Configuration page I only see “Git” and “GitHub Plugin Configuration”. I do not see “GitHub Web Hook” option, and also I don't see “Let Jenkins auto-manage hook URLs” has this changed in version 1.646

2>在Jenkins的系统配置页面我只看到“Git”和“GitHub插件配置”。我没有看到“GitHub Web Hook”选项，也没有看到“让 Jenkins 自动管理钩子 URL”在 1.646 版本中有所改变

3> Since we are using private repository, our project URL is https://github.com/MyCompanyName/reponameand repository URL is https://github.com/MyCompanyName/reponame.gitnote that the url has company name not the username. But I see error Jenkins log

3> 由于我们使用的是私有仓库，我们的项目 URL 是https://github.com/MyCompanyName/reponame并且仓库 URL 是https://github.com/MyCompanyName/reponame.git请注意 URL 有公司名称而不是用户名。但我看到错误 Jenkins 日志

Failed to remove hook from GitHubRepositoryName[host=github.com,username=MyCompanyName,repository=reponame] java.lang.NullPointerException: There is no credentials with admin access to manage hooks on GitHubRepositoryName[host=github.com,username=MyCompanyName,repository=reponame] at com.google.common.base.Preconditions.checkNotNull(Preconditions.java:231)

无法从 GitHubRepositoryName[host=github.com,username=MyCompanyName,repository=reponame] java.lang.NullPointerException 中删除挂钩失败：没有具有管理员权限的凭据来管理 GitHubRepositoryName[host=github.com,username=MyCompanyName, repository=reponame] 在 com.google.common.base.Preconditions.checkNotNull(Preconditions.java:231)

Why its trying to use companyname as username? I have setup proper user credentials and it was able to PULL the code.

为什么它试图使用公司名称作为用户名？我已经设置了正确的用户凭据，它能够拉取代码。

采纳答案by Skydan

1) Go to Configure global Security and uncheck "Allow users to sign up" to prevent creation of new accounts.

1) 转到配置全局安全性并取消选中“允许用户注册”以防止创建新帐户。

2&3) Go to Configure System/Github Plugin Configuration section and uncheck "Manage hook" if you don't have admin access or don't want to manage hooks from Jenkins.

2&3) 如果您没有管理员权限或不想从 Jenkins 管理钩子，请转到配置系统/Github 插件配置部分并取消选中“管理钩子”。

回答by kuzyn

I'll add a second answer for other like me who stumbled here but couldn't fix it with the steps above:

我将为其他像我一样在这里绊倒但无法通过上述步骤修复它的人添加第二个答案：

1) Make sure to remove the trailling .gitfrom your task SCM config

1) 确保.git从您的任务 SCM 配置中 删除尾随

2) Make sure that you have set an ip/domain in Jenkins that can be reached by Github, since this is what will be used to create the hooks in your repos. This might be set to loopback by default if you are running in a VM for example

2) 确保您在 Jenkins 中设置了一个 Github 可以访问的 ip/域，因为这将用于在您的存储库中创建钩子。例如，如果您在 VM 中运行，这可能会默认设置为环回

Results in this bad config in Github

在 Github 中导致这个错误的配置

3) Restart Jenkins with http://your-jenkins-address:port/restart

3）重新启动詹金斯 http://your-jenkins-address:port/restart