Re: Jenkins- Best Practices for Security

2014-08-01 Thread Stephen Connolly
Our CloudBees RBAC proprietary plugin provides a lot mire flexibility in delegation of group management than most authorisation strategies. There are, however, limits to what you can achieve. Ultimately you should not currently delegate the ability to manage nodes to users that you do not trust.

Re: Jenkins- Best Practices for Security

2014-08-01 Thread Rahul Harikrishna
Hi Daniel, I want to provide some users the administer permissions because I want those users to "Manage Nodes" and "Manage Users". Is there anyway through which I can provide selective permissions within 'Administer' to such users? Is it possible to develop a plugin for this use case? also, I

Re: Jenkins- Best Practices for Security

2014-08-01 Thread Daniel Beck
On 01.08.2014, at 18:12, Rahul Harikrishna wrote: > One thing that I've observed that the Jenkins users with > Administer/Run_Scripts permissions get to have way more rights than they > should. For example- Why do you want to prevent administrators from doing what you describe? Don't make th

Re: Jenkins- Best Practices for Security

2014-08-01 Thread Rahul Harikrishna
Hello Stephen, Thanks a lot for your reply. I understand that the weakest link is the source code in the SCM. But assuming that the code coming from SCM is trusted in the main branch of project, as multiple people review the code before it gets pushed to the master. One thing that I've observe

Re: Jenkins- Best Practices for Security

2014-07-31 Thread Stephen Connolly
On Thursday, 31 July 2014, Rahul Harikrishna wrote: > Hello Jenkins Users !! > > I'm a Jenkins Newbie and from a security background... > > 1. I'm wondering what kind of System-level hardening must be done on > Jenkins Masters server instances? Also on the slaves machines ? > In general you want