1

Suppose there are two users who have created two different jobs on the Jenkins server. Each user can only access, configure and run his own job. On each job, they are going to execute a remote ssh command. So I have configured two "SSH remote hosts" through "Manage Jenkins > Configure System > SSH remote hosts" (the SSH plugin is installed). Now in the build section of each job, it's possible to select one of these two ssh connections to execute a remote command. My question is, how to restrict access of users to these ssh connections. I want each user to only be able to access his own SSH connection, so that they cannot execute commands on the remote computers they should not have access to.

(I am using Jenkins to execute automatic test scripts for projects. This is how it works: I bind a job to the SVN address of a development project, Jenkins checkouts that address frequently to see if the source code of project has changed, if so, then build steps are run. Through these build steps, I run test scripts on remote machines and if any of these tests fail, the Jenkins job becomes cloudy meaning there is something wrong in the source code of project.)

Improve this question
3
  • I'm not sure you can. Might I ask why there needs to be this security layer when users are already logging in and configuring their own jobs
    – Toby Jackson
    Jan 13, 2014 at 7:21
  • @TobyJackson When configuring their own job, they have access to all the created SSH connections, and can select any of them from the drop-down menu. So they can execute remote commands on all of the available SSH connections. That's what concerns me and I want to restrict.
    – B Faley
    Jan 13, 2014 at 7:26
  • The second option I've given below might work for you then. If your users login to machines using their own credentials, and other users configuration aren't visible, then you can use an alternative plugin to run the ssh calls and pass credentials at runtime rather than from global configuration in Jenkins.
    – Toby Jackson
    Jan 13, 2014 at 7:33

1 Answer 1

Reset to default
2

You might be able to do something by swapping out the login shell from /bin/sh to /usr/local/someLoginCheck script so that when users use the ssh remote it checks the job name or some other environment variable set in the job. For example, at the top of the users script:

#!/usr/local/someLoginCheck a650ef01ddcf4e1bfb68ee0af5566170

Another option would be to use the Publish Over SSH Plugin which can let you specify credentials to use during the connection - This would let you issue credentials to each user, and then have the server decide whether to allow the connection or not.

enter image description here

Improve this answer
2
  • Thank you. Do I need to use "ssh-keygen" to generate ssh private key before using this plugin?
    – B Faley
    Jan 13, 2014 at 8:34
  • Not necessarily, it can either be setup to have a users username and password, or a keyfile with passphrase. The various input fields just let you setup the credentials in a few ways eg; Username+Password, Username + Path to key on jenkins master, Username + path + passphrase etc. If you'd like the most secure method, use the username, a path to key on the jenkins master and a passphrase. It prevents the private key being exposed through the config ui (though its probably still accessible in other ways)
    – Toby Jackson
    Jan 13, 2014 at 9:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.