Jenkins & Public-Facing Servers
Explore how to secure Jenkins servers by enforcing login and patching to prevent unauthorized command execution. Learn to identify, clean up, and automate monitoring of public-facing servers to reduce risks from forgotten or unpatched systems exposed to the internet.
We'll cover the following...
Jenkins
If we use Jenkins, we need to keep it patched, as we discussed back in Chapter 1: Patching.
But Jenkins has a common misconfiguration that merits special mention. Jenkins instances are often started with insecure settings that allow for unauthenticated execution of commands in a scripting language called Groovy. Groovy scripts can execute arbitrary shell commands. So a common attack is to scan the network for misconfigured Jenkins servers, use the Groovy Scripting Console to dump ...