I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects.

I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I have one step in my build process where I need to restart my nginx using sudo.

According to this solution, it suggests to allow jenkins to use sudo without password.

And also, it is not entirely sure about the security implications for such an arrangement.

I want to ask whether I should go ahead with this arrangement.

I installed the jenkins on the same server as the production code.

2 Answers 2


The linked solution allows jenkins to run any command via sudo without a password.

A better solution is to allow jenkins to restart nginx without a password, but nothing else. This way you have root permission for the command you need to execute, but you're not granting blanket permission for jenkins to do anything and everything.

Use visudo to stick this at the bottom of your sudoers file:

Defaults:jenkins !requiretty,!lecture
jenkins ALL=NOPASSWD:/etc/init.d/nginx
  • this failed to work for myself.. on apache. says sudo: no tty present and no askpass program specified
    – Erik
    Jun 5, 2014 at 22:54
  • @Erik That means you did something wrong.
    – tylerl
    Jun 5, 2014 at 23:45
  • I guess from the shell directly it doesn't work.. but it does inside of ant
    – Erik
    Jun 6, 2014 at 0:01

Why do you have to run nginx as root on your development server? Run it as a normal user so jenkins can restart it without root permissions.

Also, what do you mean by "jenkins is on the same server as the production code"? If you mean that your production application is actually running on your development server: That is a bad idea (for security and performance reasons) and you should change it asap.

edit to answer followup questions:

I'm suggesting two servers, one production server and one that runs jenkins, your SCM, etc... If you're the only developer, the second one can also be your development workstation if you want. And no, you don't need to run nginx as the jenkins user, you just need a configuration that will allow jenkins to restart nginx (eg, same group for jenkins and the nginx-restart-script plus rwxr-x--- permissions or similar).

  • Run it as a normal user so jenkins can restart it without root permissions. You mean as the same user group as the jenkins user?
    – Kim Stacks
    Dec 29, 2012 at 11:11
  • My second follow up question is so do you mean I have one server for jenkins, one for production server, and one for development server? In total 3?
    – Kim Stacks
    Dec 29, 2012 at 11:12
  • I have edited my answer to address your questions.
    – us2012
    Dec 29, 2012 at 12:40
  • thanks for your edit. I have one more follow up question. Based on your edit about having one production server and one that runs jenkins, if i also need to have a webapp.com which is my production and a stage.webapp.com which is a stage environment. Both production environment and stage environment would be accessing similar user generated content files and data. The stage environment will use a duplicate of the production database to prevent accidental overwrites. The UGC files would also be duplicated. In this setup, do I still use the same setup as you advised?
    – Kim Stacks
    Dec 29, 2012 at 13:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .