Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add blog post on new CLI in Jenkins 2.54 #817

Merged
merged 3 commits into from
Apr 11, 2017
Merged

Add blog post on new CLI in Jenkins 2.54 #817

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a70b1c2
Add blog post on new CLI in Jenkins 2.54
daniel-beck Apr 9, 2017
7203244
Address review comment
daniel-beck Apr 9, 2017
4601044
Move CLI blog post to Tuesday
daniel-beck Apr 10, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions content/blog/2017/2017-04-10-new-cli.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
---
:layout: post
:title: New, safer CLI in 2.54
:tags:
- plugins
- security
:author: daniel-beck
---

In response to the link:/blog/2016/11/16/security-updates-addressing-zero-day/[zero-day vulnerability we fixed in November], I wrote the following:

____
Moving forward, the Jenkins security team is revisiting the design of the Jenkins CLI over the coming weeks to prevent this class of vulnerability in the future.
If you are interested in participating in that discussion, please join in on the jenkinsci-dev@ mailing list.
____
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

NIT: using [quote] instead of ----- would feel more idiomatic asciidoc IMO.


In early February, several link:https://jenkins.io/blog/2017/03/16/fosdem-event-report[project contributors met after FOSDEM for a one day hackathon].
I looked into the feasibility of a purely SSH-based CLI.
While I considered link:https://github.com/daniel-beck/jenkins-ssh-cli[the experiment] to be a success, it was far from ready to be used in a production environment.

A few weeks later, long-time contributor and Jenkins security team member link:https://github.com/jglick/[Jesse Glick] link:https://groups.google.com/d/msg/jenkinsci-dev/ijnIr8LhBG0/CrdANP8eEAAJ[took over], and link:https://gist.github.com/jglick/9721427da892a9b2f75dc5bc09f8e6b3[published a detailed proposal for a new, simple CLI protocol without remoting].

In just a month, he implemented his proposal, and I'm very happy to announce that this new implementation of the Jenkins CLI has now made it into 2.54!

Existing `jenkins-cli.jar` clients should continue working as before, unless an administrator disables the remoting connection mode in _Configure Global Security_.
That said, we recommend you download the new `jenkins-cli.jar` in Jenkins, and use its the new `-http` mode.
This will allow you to disable the remoting mode for the CLI on the Jenkins master to prevent similar vulnerabilities in the future.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It worth mentioning that there are some limitations being compared to the remoting mode

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that's best left to the full documentation, which I link to.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reconsidered and updated the blog post.


SSH-based CLI use should be unaffected by this change.
Note that new Jenkins instances now start with the SSH server port disabled, and the configuration option for that was moved into _Configure Global Security_.

You can learn all about the CLI and its new behavior in link:https://jenkins.io/doc/book/managing/cli[the Jenkins handbook].