Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-70168

Generate random secret for agent connection

XMLWordPrintable

    • Icon: Improvement Improvement
    • Resolution: Unresolved
    • Icon: Minor Minor
    • core

      Context

      It was reported as https://issues.jenkins.io/browse/SECURITY-2425, but considered as an improvement instead of a vulnerability. The documentation was updated in https://github.com/jenkinsci/remoting/pull/476.
      Also discussed in https://github.com/jenkinsci/docker-inbound-agent/pull/76#issuecomment-1329019981.

      Idea

      Currently the HMAC is generated using the agent name, which is deterministic. It could be also potentially reused, generating potential issues. Having a randomly generated secret during agent creation could ease reusability of name and configuration through JCasC.

          [JENKINS-70168] Generate random secret for agent connection

          Wadeck Follonier created issue -
          Wadeck Follonier made changes -
          Link New: This issue duplicates SECURITY-2425 [ SECURITY-2425 ]
          Jesse Glick made changes -
          Component/s New: core [ 15593 ]
          Component/s Original: remoting [ 15489 ]
          Jesse Glick made changes -
          Labels New: agents
          Jesse Glick made changes -
          Labels Original: agents New: agents security
          Jesse Glick made changes -
          Assignee Original: Jeff Thompson [ jthompson ]

            Unassigned Unassigned
            wfollonier Wadeck Follonier
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: