Questions tagged [jenkins]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
3
votes
0answers
48 views

Secure a Jenkins node to only run approved scripts?

We have a series of Jenkins nodes that are used to deploy changes onto our SQL Servers, which works fine as long as everyone behaves and can be trusted. The worry is that a rogue developer or hacker ...
1
vote
1answer
71 views

Webhook Security

I'm following this guide on: How to set up CI/CD Pipeline for a node.js app with Jenkins I've installed Jenkins on a VPS and I can access the Web UI over an SSH Tunnel. Then I saw this: http://...
0
votes
0answers
31 views

Are JNLP connectors safe? How can I configure Jenkins to install it safely?

Is there a modification I can make to these installation arguments to make a Jenkins slave installation more secure... java -jar agent.jar -jnlpURL https://myserver/computer/myslave/slave-agent.jnlp -...
1
vote
2answers
369 views

Jenkins malicious process identification

I have a Jenkins (v2.120) machine hosted on AWS which has what looks like a malicious process: process has large CPU usage killing it, respawns it (with same name) restarting machine spawns it (with ...
1
vote
0answers
519 views

OWASP ZAP does not scan all urls in Jenkins

I have two set ups with ZAP and Selenium, local and on Jenkins. Locally, I can start ZAP, run a Selenium process with ZAP as a proxy and then start the spider and then put ZAP in attack mode. This ...
2
votes
1answer
534 views

Running Selenium Jenkins, through OWASP ZAP, before scanning

I suspect that what I am trying to do is something that has been done before. Hopefully, this is possible and someone knows how its done. Any information would be greatly appreciated. I am attempting ...
1
vote
1answer
142 views

What is the expected TLS traffic from Jenkins?

Given: We start a Jenkins instance on a Windows host as a Service. It looks like the server is correctly configured (--httpPort=-1 --httpsPort=8080 etc) and has an own key store. There is no proxy in ...
2
votes
3answers
938 views

Owasp Zap's active scan harming the database

I want to integrate OWASP Zap security tests in my continuous integration chain using the official Jenkins plugin. However, since it injects harmful payloads in database, I don't want the database to ...
3
votes
2answers
2k views

HP Fortify scan automation

I am asked to integrate the code audit tool HP Fortify in our development process, but the main constraint about it is that the whole code should not be scanned every time: only the classes impacted ...
0
votes
0answers
1k views

ERR_SSL_PROTOCOL_ERROR on a site that doesn't use SSL/TLS, on an odd port

I've set up a server running Jenkins. The web-interface doesn't have SSL/TLS support turned on by default, and I have not attempted to turn it on, and do not want to turn it on (for now at least). ...