Jenkins Security Flashcards

How should Jenkins be configured to serve traffic over HTTPS?

Answer: Configure a reverse proxy like Nginx/Apache with TLS termination in front of Jenkins

The recommended approach is to place a reverse proxy (Nginx, Apache, or a load balancer) in front of Jenkins to handle TLS termination.

What is the risk of using `--argumentsRealm.roles.user=admin` startup flag in Jenkins?

Answer: It bypasses the configured authentication realm, allowing login with hardcoded credentials — a significant security risk

Using the argumentsRealm startup flag hardcodes credentials in the startup command, bypassing the normal security realm and potentially exposing credentials.

What is the purpose of the 'Markup Formatter' setting under Configure Global Security?

Answer: Controls whether user-supplied text (descriptions, comments) is sanitized to prevent XSS attacks

The Markup Formatter setting controls how user-supplied HTML in job descriptions is rendered; 'Safe HTML' sanitizes it to prevent cross-site scripting.

Which Jenkins security feature restricts certain HTTP methods like PUT and DELETE on the Jenkins API?

Answer: CSRF Protection (crumb issuer)

The CSRF crumb issuer ensures state-changing requests (POST, PUT, DELETE) include a valid CSRF token, restricting unauthorized method calls.

Which permission allows a user to read job configurations but not modify them in Jenkins Matrix security?

Answer: Job/Read

The Job/Read permission allows a user to view a job's configuration and build history without being able to change anything.

What is the recommended way to store secrets (like API keys) in a Jenkins Pipeline?

Answer: Store them in Jenkins Credentials store and reference via withCredentials or environment directive

Secrets should be stored in the Jenkins Credentials store and retrieved at runtime using `withCredentials` or the `credentials()` helper, never hardcoded.