安全配置 #

┌─────────────────────────────────────────────────────────────┐
│                    Jenkins 安全架构                          │
├─────────────────────────────────────────────────────────────┤
│                                                              │
│  ┌─────────────────┐  ┌─────────────────┐                  │
│  │     认证        │  │     授权        │                  │
│  │  (Authentication)│  │  (Authorization)│                  │
│  │                 │  │                 │                  │
│  │  - 用户名密码   │  │  - 全局安全     │                  │
│  │  - LDAP         │  │  - 项目安全     │                  │
│  │  - SAML         │  │  - 角色策略     │                  │
│  │  - OAuth        │  │  - 矩阵策略     │                  │
│  └─────────────────┘  └─────────────────┘                  │
│                                                              │
│  ┌─────────────────┐  ┌─────────────────┐                  │
│  │    凭据管理     │  │    网络安全     │                  │
│  │                 │  │                 │                  │
│  │  - 密码存储     │  │  - CSRF保护     │                  │
│  │  - SSH密钥      │  │  - 跨域请求     │                  │
│  │  - 证书         │  │  - 代理设置     │                  │
│  └─────────────────┘  └─────────────────┘                  │
│                                                              │
└─────────────────────────────────────────────────────────────┘

Security Realm: Jenkins' own user database
☑ Allow users to sign up

Security Realm: LDAP
Server: ldap://ldap.example.com:389
root DN: dc=example,dc=com
User search base: ou=users
User search filter: uid={0}
Group search base: ou=groups
Group search filter: cn={0}
Manager DN: cn=admin,dc=example,dc=com
Manager Password: ********

Security Realm: SAML 2.0
IdP Metadata URL: https://idp.example.com/metadata
Entity ID: https://jenkins.example.com

Security Realm: GitHub Authentication Plugin
GitHub Web URI: https://github.com
GitHub API URI: https://api.github.com
Client ID: your-client-id
Client Secret: ********

Authorization: Anyone can do anything

Authorization: Matrix-based security

Authorization: Project-based Matrix Authorization Strategy

Authorization: Role-Based Strategy

Manage Roles → Global roles

admin:
  - Overall/Administer
  - Overall/Read
  
developer:
  - Overall/Read
  - Job/Read
  - Job/Build
  - Job/Configure
  
viewer:
  - Overall/Read
  - Job/Read

Manage Roles → Project roles

pattern: dev-.*
  - Job/Read
  - Job/Build
  - Job/Configure
  - Job/Workspace

pattern: prod-.*
  - Job/Read
  - Job/Build

Assign Roles → Global roles
admin: user1, user2
developer: user3, user4
viewer: user5

Assign Roles → Project roles
dev-.*: user3, user4
prod-.*: user1

JENKINS_HOME/
├── credentials.xml
└── secrets/
    ├── master.key
    └── hudson.util.Secret

CSRF Protection: ☑ Enable CSRF Protection

Access Control:
  TCP port for JNLP agents: Fixed: 50000
  ☑ Enable security

HTTP Proxy Configuration:
  Server: proxy.example.com
  Port: 8080
  No Proxy Host: localhost, 127.0.0.1

server {
    listen 443 ssl;
    server_name jenkins.example.com;
    
    ssl_certificate /etc/nginx/ssl/cert.pem;
    ssl_certificate_key /etc/nginx/ssl/key.pem;
    
    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

TCP port for JNLP agents:
  - Disable: 禁用JNLP Agent
  - Fixed: 使用固定端口
  - Random: 使用随机端口

Agent Protocols:
  ☑ JNLP4-connect (recommended)
  ☐ JNLP2-connect (deprecated)
  ☐ JNLP-connect (deprecated)

Agent → Security:
  ☑ Enable Agent → Master Access Control