Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects.

I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I have one step in my build process where I need to restart my nginx using sudo.

According to this solution, it suggests to allow jenkins to use sudo without password.

And also, it is not entirely sure about the security implications for such an arrangement.

I want to ask whether I should go ahead with this arrangement.

I installed the jenkins on the same server as the production code.

share|improve this question
add comment

2 Answers

The linked solution allows jenkins to run any command via sudo without a password.

A better solution is to allow jenkins to restart nginx without a password, but nothing else. This way you have root permission for the command you need to execute, but you're not granting blanket permission for jenkins to do anything and everything.

Use visudo to stick this at the bottom of your sudoers file:

Defaults:jenkins !requiretty,!lecture
jenkins ALL=NOPASSWD:/etc/init.d/nginx
share|improve this answer
    
thank you , i will give this a shot! –  Kim Stacks Jan 1 '13 at 2:30
add comment

Why do you have to run nginx as root on your development server? Run it as a normal user so jenkins can restart it without root permissions.

Also, what do you mean by "jenkins is on the same server as the production code"? If you mean that your production application is actually running on your development server: That is a bad idea (for security and performance reasons) and you should change it asap.

edit to answer followup questions:

I'm suggesting two servers, one production server and one that runs jenkins, your SCM, etc... If you're the only developer, the second one can also be your development workstation if you want. And no, you don't need to run nginx as the jenkins user, you just need a configuration that will allow jenkins to restart nginx (eg, same group for jenkins and the nginx-restart-script plus rwxr-x--- permissions or similar).

share|improve this answer
    
Run it as a normal user so jenkins can restart it without root permissions. You mean as the same user group as the jenkins user? –  Kim Stacks Dec 29 '12 at 11:11
    
My second follow up question is so do you mean I have one server for jenkins, one for production server, and one for development server? In total 3? –  Kim Stacks Dec 29 '12 at 11:12
    
I have edited my answer to address your questions. –  us2012 Dec 29 '12 at 12:40
    
thanks for your edit. I have one more follow up question. Based on your edit about having one production server and one that runs jenkins, if i also need to have a webapp.com which is my production and a stage.webapp.com which is a stage environment. Both production environment and stage environment would be accessing similar user generated content files and data. The stage environment will use a duplicate of the production database to prevent accidental overwrites. The UGC files would also be duplicated. In this setup, do I still use the same setup as you advised? –  Kim Stacks Dec 29 '12 at 13:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.