Merge pull request #817 from daniel-beck/2017-04-blog-new-cli

Add blog post on new CLI in Jenkins 2.54

content/blog/2017/2017-04-11-new-cli.adoc

@@ -0,0 +1,33 @@
+---
+:layout: post
+:title: New, safer CLI in 2.54
+:tags:
+- plugins
+- security
+:author: daniel-beck
+---
+
+In response to the link:/blog/2016/11/16/security-updates-addressing-zero-day/[zero-day vulnerability we fixed in November], I wrote the following:
+
+____
+Moving forward, the Jenkins security team is revisiting the design of the Jenkins CLI over the coming weeks to prevent this class of vulnerability in the future.
+If you are interested in participating in that discussion, please join in on the jenkinsci-dev@ mailing list.
+____
+
+In early February, several link:https://jenkins.io/blog/2017/03/16/fosdem-event-report[project contributors met after FOSDEM for a one day hackathon].
+I looked into the feasibility of a purely SSH-based CLI.
+While I considered link:https://github.com/daniel-beck/jenkins-ssh-cli[the experiment] to be a success, it was far from ready to be used in a production environment.
+
+A few weeks later, long-time contributor and Jenkins security team member link:https://github.com/jglick/[Jesse Glick] link:https://groups.google.com/d/msg/jenkinsci-dev/ijnIr8LhBG0/CrdANP8eEAAJ[took over], and link:https://gist.github.com/jglick/9721427da892a9b2f75dc5bc09f8e6b3[published a detailed proposal for a new, simple CLI protocol without remoting].
+
+In just a month, he implemented his proposal, and I'm very happy to announce that this new implementation of the Jenkins CLI has now made it into 2.54!
+
+Existing `jenkins-cli.jar` clients should continue working as before, unless an administrator disables the remoting connection mode in _Configure Global Security_.
+That said, we recommend you download the new `jenkins-cli.jar` in Jenkins, and use its the new `-http` mode.
+With few (now deprecated) exceptions, CLI commands work like before.
+This will allow you to disable the remoting mode for the CLI on the Jenkins master to prevent similar vulnerabilities in the future.
+
+SSH-based CLI use should be unaffected by this change.
+Note that new Jenkins instances now start with the SSH server port disabled, and the configuration option for that was moved into _Configure Global Security_.
+
+You can learn all about the CLI and its new behavior in link:https://jenkins.io/doc/book/managing/cli[the Jenkins handbook].