Re: Is adding private key to Jenkins credential list a security breach?

2016-09-20 Thread Michael Lasevich
You got it backwards, master connects to Slave using standard SSH Pub/Private key auth. So, since the master is connecting to slave, you are not putting Slave's private keys on Master, you are putting Master's public key on Slave. While this looks like same thing physically, logically it explai

Re: Is adding private key to Jenkins credential list a security breach?

2016-09-20 Thread Stephen Connolly
So when you add a private key for use to connect to agents, that private key will be in the System store. The System store maintains two scopes: SYSTEM (which is only available for "system" tasks and not available to build jobs) and GLOBAL (which is available for both "system" tasks and build jobs)

Re: Is adding private key to Jenkins credential list a security breach?

2016-09-20 Thread thomas . lehmann
It's a matter how it is organized ... If administrators only (a limited number of persons) have access to the manage section in Jenkins then it's probably a first step. Also an option might be to use Vault. On Monday, September 19, 2016 at 3:57:58 AM UTC+2, John Cho wrote: > > Hi, > I am reading

Is adding private key to Jenkins credential list a security breach?

2016-09-18 Thread John Cho
Hi, I am reading thru how to set up slaves on Jenkins using ssh keys. Read thru about three articles on how to do that. According to them, the setup is based upon using the slave as a ssh server with public and private keys and it adds the slave's private key to the Jenkins master's credenti