Jenkins should be secure out of the box by default

This issue is archived. You can view it, but you can't modify it. Learn more

XMLWordPrintable

      The default setup is of jenkins should be secure out-of-the-box and the admin must change it to be insecure if they desire.

      • Things like listen on localhost only (for http/https/ssh/cli etc)
      • ship with jenkins own security realm by default without allow users to sign up and a single admin user pre-defined.
      • Force password expiry on the local user database (to ensure the password is changed at first login)
      • Local user database should be able to support locking accounts (to prevent brute force attacks)

      See also: Design

            Assignee:
            Keith Zantow
            Reporter:
            James Nord
            Archiver:
            Jenkins Service Account

              Created:
              Updated:
              Resolved:
              Archived: