Jenkins Security Flashcards

What is the Jenkins API token used for?

Answer: Authenticating API or CLI calls without using the user's password

Jenkins API tokens allow users and scripts to authenticate to the Jenkins API or CLI without exposing the actual user password.

Which LDAP setting in Jenkins specifies the attribute used to find the user's username in the directory?

Answer: User ID attribute

The User ID attribute specifies which LDAP attribute (e.g., `uid` or `sAMAccountName`) maps to the Jenkins username.

What is Script Security in Jenkins and what does it protect?

Answer: It sandboxes Groovy scripts in pipelines and approves safe operations to prevent malicious code execution

Script Security sandboxes Groovy code in pipelines and Groovy scripts, requiring admin approval for unsafe operations to prevent code injection.

What does marking a script as 'approved' in Jenkins Script Security mean?

Answer: An admin has reviewed and whitelisted specific Groovy methods or the entire script to run without sandbox restrictions

When an admin approves a script or method in the Script Security plugin, it is whitelisted to run outside the Groovy sandbox.

What is the purpose of Agent-to-Controller Security in Jenkins?

Answer: Restricts what commands agents can send to the controller to prevent a compromised agent from attacking the controller

Agent-to-Controller Security restricts the commands agents can request of the controller, limiting the blast radius if an agent node is compromised.

Which Jenkins feature allows auditing who changed a job's configuration and when?

Answer: Audit Trail Plugin

The Audit Trail Plugin logs user actions in Jenkins including job configuration changes, builds triggered, and who performed them.