第7章安全配置

7.1 安全概述

Jenkins安全威脅

常見安全風險：

訪問控制風險：
- 未授權訪問Jenkins實例
- 權限提升攻擊
- 橫向移動攻擊
- 敏感信息泄露代碼執行風險：
- 惡意腳本注入
- 構建腳本篡改
- 插件漏洞利用
- 遠程代碼執行數據安全風險：
- 憑據泄露
- 源碼泄露
- 構建產物泄露
- 配置信息泄露網絡安全風險：
- 中間人攻擊
- 網絡嗅探
- DDoS攻擊
- 內網滲透

安全威脅模型：

外部威脅：
├── 網絡攻擊者
│   ├── 暴力破解
│   ├── 漏洞利用
│   └── 社會工程學
├── 惡意軟件
│   ├── 木馬植入
│   ├── 勒索軟件
│   └── 挖礦程序
└── 供應鏈攻擊├── 惡意插件├── 依賴投毒└── 鏡像污染內部威脅：
├── 惡意內部人員
│   ├── 權限濫用
│   ├── 數據竊取
│   └── 破壞活動
├── 無意泄露
│   ├── 配置錯誤
│   ├── 誤操作
│   └── 弱密碼
└── 特權賬戶├── 共享賬戶├── 默認密碼└── 過期權限

安全框架

縱深防御策略：

網絡層安全：
- 防火墻配置
- VPN訪問
- 網絡隔離
- 流量監控應用層安全：
- 身份認證
- 訪問控制
- 輸入驗證
- 輸出編碼數據層安全：
- 數據加密
- 備份保護
- 訪問審計
- 數據脫敏運維層安全：
- 安全監控
- 日志審計
- 漏洞管理
- 應急響應

安全合規要求：

行業標準：
- ISO 27001: 信息安全管理體系
- NIST Cybersecurity Framework
- OWASP Top 10
- CIS Controls法規要求：
- GDPR: 通用數據保護條例
- SOX: 薩班斯-奧克斯利法案
- HIPAA: 健康保險便攜性和責任法案
- PCI DSS: 支付卡行業數據安全標準企業政策：
- 密碼策略
- 訪問控制策略
- 數據分類策略
- 事件響應策略

7.2 身份認證

內置用戶管理

用戶數據庫配置：

啟用步驟：
1. 進入 "Manage Jenkins" → "Configure Global Security"
2. 選擇 "Security Realm" → "Jenkins' own user database"
3. 勾選 "Allow users to sign up"
4. 配置密碼策略
5. 保存配置用戶注冊流程：
1. 訪問 /signup 頁面
2. 填寫用戶信息
3. 設置密碼
4. 郵箱驗證（可選）
5. 管理員審批（可選）

密碼策略配置：

// 通過Groovy腳本配置密碼策略
import jenkins.model.Jenkins
import hudson.security.HudsonPrivateSecurityRealm
import hudson.security.SecurityRealmdef jenkins = Jenkins.instance
def securityRealm = jenkins.getSecurityRealm()if (securityRealm instanceof HudsonPrivateSecurityRealm) {// 設置密碼策略securityRealm.setPasswordPolicy([minLength: 8,requireUppercase: true,requireLowercase: true,requireDigit: true,requireSymbol: true,maxAge: 90, // 密碼有效期（天）historySize: 5 // 密碼歷史記錄])jenkins.save()println "密碼策略配置完成"
} else {println "當前未使用Jenkins內置用戶數據庫"
}

用戶管理腳本：

// 批量創建用戶
import jenkins.model.Jenkins
import hudson.security.HudsonPrivateSecurityRealm
import hudson.model.Userdef jenkins = Jenkins.instance
def securityRealm = jenkins.getSecurityRealm()if (securityRealm instanceof HudsonPrivateSecurityRealm) {// 用戶列表def users = [[username: 'developer1', password: 'Dev@123456', fullName: '開發者1', email: 'dev1@company.com'],[username: 'developer2', password: 'Dev@123456', fullName: '開發者2', email: 'dev2@company.com'],[username: 'tester1', password: 'Test@123456', fullName: '測試員1', email: 'test1@company.com'],[username: 'ops1', password: 'Ops@123456', fullName: '運維員1', email: 'ops1@company.com']]users.each { userInfo ->try {// 創建用戶def user = securityRealm.createAccount(userInfo.username, userInfo.password)// 設置用戶屬性user.setFullName(userInfo.fullName)user.addProperty(new hudson.tasks.Mailer.UserProperty(userInfo.email))user.save()println "用戶 ${userInfo.username} 創建成功"} catch (Exception e) {println "用戶 ${userInfo.username} 創建失敗: ${e.message}"}}jenkins.save()
} else {println "當前未使用Jenkins內置用戶數據庫"
}

LDAP集成

LDAP配置：

LDAP服務器配置：
Server: ldap://ldap.company.com:389
Root DN: dc=company,dc=com
User search base: ou=users,dc=company,dc=com
User search filter: (uid={0})
Group search base: ou=groups,dc=company,dc=com
Group search filter: (member={0})
Group membership filter: (memberOf={0})管理員DN: cn=admin,dc=company,dc=com
管理員密碼: [管理員密碼]高級配置：
? Enable cache
Cache size: 100
Cache TTL: 300 seconds
? Enable StartTLS

LDAP配置腳本：

// LDAP配置腳本
import jenkins.model.Jenkins
import hudson.security.LDAPSecurityRealm
import hudson.security.LDAPSecurityRealm.LDAPConfigurationdef jenkins = Jenkins.instance// LDAP配置
def ldapConfigurations = [new LDAPConfiguration("ldap://ldap.company.com:389", // server"dc=company,dc=com", // rootDNfalse, // inhibitInferRootDN"cn=admin,dc=company,dc=com", // managerDN"admin_password", // managerPasswordSecret"ou=users,dc=company,dc=com", // userSearchBase"(uid={0})", // userSearch"ou=groups,dc=company,dc=com", // groupSearchBase"(member={0})", // groupSearchFilternew LDAPSecurityRealm.LDAPGroupMembershipStrategy(), // groupMembershipStrategy"displayName", // displayNameAttributeName"mail", // mailAddressAttributeNametrue, // disableMailAddressResolvertrue, // cachenull, // environmentPropertiesnull, // extraEnvVarsLDAPSecurityRealm.DescriptorImpl.DEFAULT_CACHE_SIZE, // cacheSizeLDAPSecurityRealm.DescriptorImpl.DEFAULT_CACHE_TTL // cacheTTL)
]// 創建LDAP安全域
def ldapSecurityRealm = new LDAPSecurityRealm(ldapConfigurations,false, // disableMailAddressResolvernull, // groupIdStrategynull // userIdStrategy
)// 應用配置
jenkins.setSecurityRealm(ldapSecurityRealm)
jenkins.save()println "LDAP配置完成"

LDAP測試腳本：

// LDAP連接測試
import javax.naming.Context
import javax.naming.directory.DirContext
import javax.naming.directory.InitialDirContext
import javax.naming.directory.SearchControls
import javax.naming.directory.SearchResultdef testLDAPConnection() {def env = new Hashtable<String, String>()env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory")env.put(Context.PROVIDER_URL, "ldap://ldap.company.com:389")env.put(Context.SECURITY_AUTHENTICATION, "simple")env.put(Context.SECURITY_PRINCIPAL, "cn=admin,dc=company,dc=com")env.put(Context.SECURITY_CREDENTIALS, "admin_password")try {DirContext ctx = new InitialDirContext(env)// 搜索用戶def searchControls = new SearchControls()searchControls.setSearchScope(SearchControls.SUBTREE_SCOPE)def results = ctx.search("ou=users,dc=company,dc=com", "(uid=testuser)", searchControls)if (results.hasMore()) {SearchResult result = results.next()println "找到用戶: ${result.getName()}"def attributes = result.getAttributes()attributes.getAll().each { attr ->println "  ${attr.getID()}: ${attr.get()}"}} else {println "未找到測試用戶"}ctx.close()println "LDAP連接測試成功"} catch (Exception e) {println "LDAP連接測試失敗: ${e.message}"}
}testLDAPConnection()

單點登錄（SSO）

SAML配置：

<!-- SAML配置示例 -->
<saml2:EntityDescriptor xmlns:saml2="urn:oasis:names:tc:SAML:2.0:metadata"entityID="http://jenkins.company.com/securityRealm/finishLogin"><saml2:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><!-- 簽名證書 --><saml2:KeyDescriptor use="signing"><ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:X509Data><ds:X509Certificate><!-- 證書內容 --></ds:X509Certificate></ds:X509Data></ds:KeyInfo></saml2:KeyDescriptor><!-- 加密證書 --><saml2:KeyDescriptor use="encryption"><ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:X509Data><ds:X509Certificate><!-- 證書內容 --></ds:X509Certificate></ds:X509Data></ds:KeyInfo></saml2:KeyDescriptor><!-- 斷言消費服務 --><saml2:AssertionConsumerServiceBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"Location="http://jenkins.company.com/securityRealm/finishLogin"index="0" isDefault="true"/></saml2:SPSSODescriptor></saml2:EntityDescriptor>

OAuth配置：

// GitHub OAuth配置
import jenkins.model.Jenkins
import org.jenkinsci.plugins.GithubSecurityRealmdef jenkins = Jenkins.instance// GitHub OAuth配置
def githubSecurityRealm = new GithubSecurityRealm("https://github.com", // githubWebUri"https://api.github.com", // githubApiUri"your_client_id", // clientID"your_client_secret", // clientSecret"read:org,user:email" // oauthScopes
)// 應用配置
jenkins.setSecurityRealm(githubSecurityRealm)
jenkins.save()println "GitHub OAuth配置完成"

多因素認證（MFA）：

// TOTP (Time-based One-Time Password) 配置
import jenkins.model.Jenkins
import hudson.plugins.otp.OtpSecurityRealmdef jenkins = Jenkins.instance// 啟用TOTP
def otpRealm = new OtpSecurityRealm(jenkins.getSecurityRealm(), // 包裝現有的安全域true, // 強制啟用TOTP30, // TOTP有效期（秒）6 // TOTP位數
)jenkins.setSecurityRealm(otpRealm)
jenkins.save()println "多因素認證配置完成"

7.3 訪問控制

授權策略

矩陣授權策略：

// 配置矩陣授權策略
import jenkins.model.Jenkins
import hudson.security.ProjectMatrixAuthorizationStrategy
import hudson.security.Permissiondef jenkins = Jenkins.instance// 創建矩陣授權策略
def strategy = new ProjectMatrixAuthorizationStrategy()// 管理員權限
strategy.add(Jenkins.ADMINISTER, "admin")
strategy.add(Jenkins.READ, "admin")// 開發者權限
strategy.add(Jenkins.READ, "developers")
strategy.add(hudson.model.Item.BUILD, "developers")
strategy.add(hudson.model.Item.CANCEL, "developers")
strategy.add(hudson.model.Item.READ, "developers")
strategy.add(hudson.model.Item.WORKSPACE, "developers")
strategy.add(hudson.model.Run.UPDATE, "developers")// 測試人員權限
strategy.add(Jenkins.READ, "testers")
strategy.add(hudson.model.Item.BUILD, "testers")
strategy.add(hudson.model.Item.READ, "testers")
strategy.add(hudson.model.View.READ, "testers")// 只讀用戶權限
strategy.add(Jenkins.READ, "readonly")
strategy.add(hudson.model.Item.READ, "readonly")
strategy.add(hudson.model.View.READ, "readonly")// 應用授權策略
jenkins.setAuthorizationStrategy(strategy)
jenkins.save()println "矩陣授權策略配置完成"

基于角色的授權策略：

// 配置基于角色的授權策略
import jenkins.model.Jenkins
import com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy
import com.michelin.cio.hudson.plugins.rolestrategy.Roledef jenkins = Jenkins.instance// 創建角色授權策略
def roleStrategy = new RoleBasedAuthorizationStrategy()// 全局角色
def globalRoles = [new Role("admin", "Jenkins管理員", [Jenkins.ADMINISTER,Jenkins.READ] as Set),new Role("developer", "開發人員", [Jenkins.READ,hudson.model.Item.BUILD,hudson.model.Item.CANCEL,hudson.model.Item.READ,hudson.model.Item.WORKSPACE] as Set),new Role("viewer", "查看者", [Jenkins.READ,hudson.model.Item.READ,hudson.model.View.READ] as Set)
]// 項目角色
def projectRoles = [new Role("project-admin", "項目管理員", ".*", [hudson.model.Item.BUILD,hudson.model.Item.CANCEL,hudson.model.Item.CONFIGURE,hudson.model.Item.CREATE,hudson.model.Item.DELETE,hudson.model.Item.READ,hudson.model.Item.WORKSPACE] as Set),new Role("project-developer", "項目開發者", "myproject-.*", [hudson.model.Item.BUILD,hudson.model.Item.CANCEL,hudson.model.Item.READ,hudson.model.Item.WORKSPACE] as Set)
]// 添加角色
globalRoles.each { role ->roleStrategy.addRole(RoleBasedAuthorizationStrategy.GLOBAL, role)
}projectRoles.each { role ->roleStrategy.addRole(RoleBasedAuthorizationStrategy.PROJECT, role)
}// 分配角色給用戶/組
roleStrategy.assignRole(RoleBasedAuthorizationStrategy.GLOBAL, "admin", "admin")
roleStrategy.assignRole(RoleBasedAuthorizationStrategy.GLOBAL, "developer", "developers")
roleStrategy.assignRole(RoleBasedAuthorizationStrategy.GLOBAL, "viewer", "readonly")roleStrategy.assignRole(RoleBasedAuthorizationStrategy.PROJECT, "project-admin", "project-leads")
roleStrategy.assignRole(RoleBasedAuthorizationStrategy.PROJECT, "project-developer", "myproject-team")// 應用授權策略
jenkins.setAuthorizationStrategy(roleStrategy)
jenkins.save()println "基于角色的授權策略配置完成"

項目級權限

項目安全配置：

// 為特定項目配置權限
import jenkins.model.Jenkins
import hudson.model.FreeStyleProject
import hudson.security.ProjectMatrixAuthorizationStrategy
import hudson.security.AuthorizationMatrixPropertydef jenkins = Jenkins.instance
def projectName = "sensitive-project"// 獲取項目
def project = jenkins.getItem(projectName)
if (project == null) {println "項目 ${projectName} 不存在"return
}// 創建項目級權限矩陣
def authProperty = new AuthorizationMatrixProperty()// 項目管理員權限
authProperty.add(hudson.model.Item.CONFIGURE, "project-admin")
authProperty.add(hudson.model.Item.BUILD, "project-admin")
authProperty.add(hudson.model.Item.CANCEL, "project-admin")
authProperty.add(hudson.model.Item.READ, "project-admin")
authProperty.add(hudson.model.Item.WORKSPACE, "project-admin")
authProperty.add(hudson.model.Item.DELETE, "project-admin")
authProperty.add(hudson.model.Run.DELETE, "project-admin")
authProperty.add(hudson.model.Run.UPDATE, "project-admin")// 開發者權限
authProperty.add(hudson.model.Item.BUILD, "project-developers")
authProperty.add(hudson.model.Item.CANCEL, "project-developers")
authProperty.add(hudson.model.Item.READ, "project-developers")
authProperty.add(hudson.model.Item.WORKSPACE, "project-developers")// 測試人員權限
authProperty.add(hudson.model.Item.BUILD, "project-testers")
authProperty.add(hudson.model.Item.READ, "project-testers")// 只讀權限
authProperty.add(hudson.model.Item.READ, "project-viewers")// 應用權限到項目
project.addProperty(authProperty)
project.save()println "項目 ${projectName} 權限配置完成"

文件夾級權限：

// 配置文件夾權限
import jenkins.model.Jenkins
import com.cloudbees.hudson.plugins.folder.Folder
import hudson.security.AuthorizationMatrixPropertydef jenkins = Jenkins.instance
def folderName = "production"// 獲取文件夾
def folder = jenkins.getItem(folderName)
if (folder == null || !(folder instanceof Folder)) {println "文件夾 ${folderName} 不存在"return
}// 創建文件夾級權限矩陣
def authProperty = new AuthorizationMatrixProperty()// 生產環境管理員權限
authProperty.add(hudson.model.Item.CONFIGURE, "prod-admin")
authProperty.add(hudson.model.Item.BUILD, "prod-admin")
authProperty.add(hudson.model.Item.CANCEL, "prod-admin")
authProperty.add(hudson.model.Item.CREATE, "prod-admin")
authProperty.add(hudson.model.Item.DELETE, "prod-admin")
authProperty.add(hudson.model.Item.READ, "prod-admin")
authProperty.add(hudson.model.Item.WORKSPACE, "prod-admin")// 運維人員權限
authProperty.add(hudson.model.Item.BUILD, "ops-team")
authProperty.add(hudson.model.Item.CANCEL, "ops-team")
authProperty.add(hudson.model.Item.READ, "ops-team")// 開發者只讀權限
authProperty.add(hudson.model.Item.READ, "developers")// 應用權限到文件夾
folder.addProperty(authProperty)
folder.save()println "文件夾 ${folderName} 權限配置完成"

視圖權限

視圖訪問控制：

// 配置視圖權限
import jenkins.model.Jenkins
import hudson.model.ListView
import hudson.security.AuthorizationMatrixPropertydef jenkins = Jenkins.instance
def viewName = "Development"// 獲取視圖
def view = jenkins.getView(viewName)
if (view == null) {println "視圖 ${viewName} 不存在"return
}// 創建視圖級權限矩陣
def authProperty = new AuthorizationMatrixProperty()// 開發團隊權限
authProperty.add(hudson.model.View.CONFIGURE, "dev-leads")
authProperty.add(hudson.model.View.CREATE, "dev-leads")
authProperty.add(hudson.model.View.DELETE, "dev-leads")
authProperty.add(hudson.model.View.READ, "dev-leads")// 開發者權限
authProperty.add(hudson.model.View.READ, "developers")// 測試人員權限
authProperty.add(hudson.model.View.READ, "testers")// 應用權限到視圖
view.addProperty(authProperty)
view.save()println "視圖 ${viewName} 權限配置完成"

7.4 憑據管理

憑據類型

用戶名密碼憑據：

// 創建用戶名密碼憑據
import jenkins.model.Jenkins
import com.cloudbees.plugins.credentials.SystemCredentialsProvider
import com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl
import com.cloudbees.plugins.credentials.CredentialsScopedef jenkins = Jenkins.instance
def domain = com.cloudbees.plugins.credentials.domains.Domain.global()
def store = jenkins.getExtensionList('com.cloudbees.plugins.credentials.SystemCredentialsProvider')[0].getStore()// 創建憑據
def credentials = new UsernamePasswordCredentialsImpl(CredentialsScope.GLOBAL,"database-credentials", // ID"數據庫連接憑據", // 描述"dbuser", // 用戶名"dbpassword" // 密碼
)// 添加憑據
store.addCredentials(domain, credentials)println "用戶名密碼憑據創建完成"

SSH密鑰憑據：

// 創建SSH密鑰憑據
import jenkins.model.Jenkins
import com.cloudbees.plugins.credentials.SystemCredentialsProvider
import com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey
import com.cloudbees.plugins.credentials.CredentialsScopedef jenkins = Jenkins.instance
def domain = com.cloudbees.plugins.credentials.domains.Domain.global()
def store = jenkins.getExtensionList('com.cloudbees.plugins.credentials.SystemCredentialsProvider')[0].getStore()// 讀取私鑰文件
def privateKeyFile = new File('/path/to/private/key')
def privateKey = privateKeyFile.text// 創建SSH密鑰憑據
def sshCredentials = new BasicSSHUserPrivateKey(CredentialsScope.GLOBAL,"ssh-key-credentials", // ID"SSH密鑰憑據", // 描述"git", // 用戶名new BasicSSHUserPrivateKey.DirectEntryPrivateKeySource(privateKey), // 私鑰"passphrase" // 密鑰密碼（可選）
)// 添加憑據
store.addCredentials(domain, sshCredentials)println "SSH密鑰憑據創建完成"

API Token憑據：

// 創建API Token憑據
import jenkins.model.Jenkins
import com.cloudbees.plugins.credentials.SystemCredentialsProvider
import org.jenkinsci.plugins.plaincredentials.impl.StringCredentialsImpl
import com.cloudbees.plugins.credentials.CredentialsScopedef jenkins = Jenkins.instance
def domain = com.cloudbees.plugins.credentials.domains.Domain.global()
def store = jenkins.getExtensionList('com.cloudbees.plugins.credentials.SystemCredentialsProvider')[0].getStore()// 創建API Token憑據
def tokenCredentials = new StringCredentialsImpl(CredentialsScope.GLOBAL,"github-api-token", // ID"GitHub API Token", // 描述"ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" // Token值
)// 添加憑據
store.addCredentials(domain, tokenCredentials)println "API Token憑據創建完成"

證書憑據：

// 創建證書憑據
import jenkins.model.Jenkins
import com.cloudbees.plugins.credentials.SystemCredentialsProvider
import com.cloudbees.plugins.credentials.impl.CertificateCredentialsImpl
import com.cloudbees.plugins.credentials.CredentialsScopedef jenkins = Jenkins.instance
def domain = com.cloudbees.plugins.credentials.domains.Domain.global()
def store = jenkins.getExtensionList('com.cloudbees.plugins.credentials.SystemCredentialsProvider')[0].getStore()// 讀取證書文件
def keystoreFile = new File('/path/to/keystore.p12')
def keystoreBytes = keystoreFile.bytes// 創建證書憑據
def certCredentials = new CertificateCredentialsImpl(CredentialsScope.GLOBAL,"ssl-certificate", // ID"SSL證書", // 描述"keystore_password", // 密鑰庫密碼new CertificateCredentialsImpl.UploadedKeyStoreSource(keystoreBytes) // 證書數據
)// 添加憑據
store.addCredentials(domain, certCredentials)println "證書憑據創建完成"

憑據域

創建憑據域：

// 創建特定的憑據域
import jenkins.model.Jenkins
import com.cloudbees.plugins.credentials.SystemCredentialsProvider
import com.cloudbees.plugins.credentials.domains.Domain
import com.cloudbees.plugins.credentials.domains.DomainSpecification
import com.cloudbees.plugins.credentials.domains.HostnameSpecification
import com.cloudbees.plugins.credentials.domains.SchemeSpecification
import com.cloudbees.plugins.credentials.domains.PathSpecificationdef jenkins = Jenkins.instance
def store = jenkins.getExtensionList('com.cloudbees.plugins.credentials.SystemCredentialsProvider')[0].getStore()// 創建域規范
def specifications = [new HostnameSpecification("github.com", null), // GitHub域new SchemeSpecification("https"), // HTTPS協議new PathSpecification("/api/*", null, false) // API路徑
]// 創建憑據域
def domain = new Domain("github-domain", // 域名"GitHub相關憑據域", // 描述specifications // 域規范
)// 添加域
store.addDomain(domain)println "憑據域創建完成"

域級憑據管理：

// 在特定域中管理憑據
import jenkins.model.Jenkins
import com.cloudbees.plugins.credentials.SystemCredentialsProvider
import com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl
import com.cloudbees.plugins.credentials.CredentialsScope
import com.cloudbees.plugins.credentials.domains.Domaindef jenkins = Jenkins.instance
def store = jenkins.getExtensionList('com.cloudbees.plugins.credentials.SystemCredentialsProvider')[0].getStore()// 查找特定域
def domain = store.getDomains().find { it.getName() == "github-domain" }
if (domain == null) {println "域 'github-domain' 不存在"return
}// 在特定域中創建憑據
def credentials = new UsernamePasswordCredentialsImpl(CredentialsScope.GLOBAL,"github-credentials","GitHub用戶憑據","github_username","github_password"
)// 添加到特定域
store.addCredentials(domain, credentials)println "憑據已添加到GitHub域"

憑據使用

Pipeline中使用憑據：

// Pipeline中使用各種類型的憑據
pipeline {agent anyenvironment {// 使用用戶名密碼憑據DB_CREDENTIALS = credentials('database-credentials')// 使用API TokenGITHUB_TOKEN = credentials('github-api-token')}stages {stage('使用用戶名密碼') {steps {script {// 分別訪問用戶名和密碼echo "數據庫用戶: ${DB_CREDENTIALS_USR}"// 注意：不要在日志中輸出密碼sh 'echo "連接數據庫..."'// 在腳本中使用sh """mysql -h database.company.com \-u ${DB_CREDENTIALS_USR} \-p${DB_CREDENTIALS_PSW} \-e "SELECT 1;""""}}}stage('使用SSH密鑰') {steps {// 使用SSH密鑰進行Git操作sshagent(['ssh-key-credentials']) {sh 'git clone git@github.com:company/private-repo.git'sh 'cd private-repo && git pull'}}}stage('使用API Token') {steps {script {// 使用API Token調用GitHub APIdef response = sh(script: """curl -H "Authorization: token ${GITHUB_TOKEN}" \https://api.github.com/user""",returnStdout: true).trim()echo "GitHub用戶信息: ${response}"}}}stage('使用證書') {steps {// 使用證書進行HTTPS請求withCredentials([certificate(credentialsId: 'ssl-certificate', keystoreVariable: 'KEYSTORE', passwordVariable: 'KEYSTORE_PASSWORD')]) {sh """curl --cert ${KEYSTORE}:${KEYSTORE_PASSWORD} \https://secure-api.company.com/data"""}}}stage('使用文件憑據') {steps {// 使用文件類型憑據withCredentials([file(credentialsId: 'config-file', variable: 'CONFIG_FILE')]) {sh 'cp ${CONFIG_FILE} ./app-config.json'sh 'cat ./app-config.json'}}}}post {always {// 清理敏感文件sh 'rm -f ./app-config.json'}}
}

自由風格項目中使用憑據：

// 在構建步驟中使用憑據
import jenkins.model.Jenkins
import hudson.model.FreeStyleProject
import hudson.tasks.Shell
import org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper
import org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBindingdef jenkins = Jenkins.instance
def project = jenkins.getItem("my-project")// 添加憑據綁定
def bindings = [new UsernamePasswordMultiBinding("DB_USER", // 用戶名環境變量"DB_PASS", // 密碼環境變量"database-credentials" // 憑據ID)
]def wrapper = new SecretBuildWrapper(bindings)
project.getBuildWrappersList().add(wrapper)// 添加使用憑據的構建步驟
def buildStep = new Shell("""echo "連接數據庫..."mysql -h database.company.com -u \$DB_USER -p\$DB_PASS -e "SELECT 1;"
""")project.getBuildersList().add(buildStep)
project.save()println "項目憑據配置完成"

7.5 網絡安全

HTTPS配置

SSL證書配置：

#!/bin/bash# 生成自簽名證書（僅用于測試）
generate_self_signed_cert() {echo "生成自簽名SSL證書..."# 創建證書目錄mkdir -p /etc/jenkins/sslcd /etc/jenkins/ssl# 生成私鑰openssl genrsa -out jenkins.key 2048# 生成證書簽名請求openssl req -new -key jenkins.key -out jenkins.csr -subj "/C=CN/ST=Beijing/L=Beijing/O=Company/OU=IT/CN=jenkins.company.com"# 生成自簽名證書openssl x509 -req -days 365 -in jenkins.csr -signkey jenkins.key -out jenkins.crt# 生成PKCS12格式證書（Jenkins使用）openssl pkcs12 -export -in jenkins.crt -inkey jenkins.key -out jenkins.p12 -name jenkins -password pass:changeit# 設置權限chown jenkins:jenkins /etc/jenkins/ssl/*chmod 600 /etc/jenkins/ssl/*echo "SSL證書生成完成"
}# 配置Jenkins HTTPS
configure_jenkins_https() {echo "配置Jenkins HTTPS..."# 停止Jenkinssystemctl stop jenkins# 修改Jenkins配置cat > /etc/default/jenkins << EOF
# Jenkins配置
JENKINS_PORT=-1
JENKINS_HTTPS_PORT=8443
JENKINS_HTTPS_KEYSTORE=/etc/jenkins/ssl/jenkins.p12
JENKINS_HTTPS_KEYSTORE_PASSWORD=changeit
JENKINS_HTTPS_LISTEN_ADDRESS=0.0.0.0# JVM參數
JAVA_ARGS="-Djava.awt.headless=true -Xmx2g -Xms1g"
JENKINS_ARGS="--webroot=/var/cache/jenkins/war --httpPort=\$JENKINS_PORT --httpsPort=\$JENKINS_HTTPS_PORT --httpsKeyStore=\$JENKINS_HTTPS_KEYSTORE --httpsKeyStorePassword=\$JENKINS_HTTPS_KEYSTORE_PASSWORD --httpsListenAddress=\$JENKINS_HTTPS_LISTEN_ADDRESS"
EOF# 啟動Jenkinssystemctl start jenkinsecho "Jenkins HTTPS配置完成"echo "訪問地址: https://jenkins.company.com:8443"
}# 配置反向代理（Nginx）
configure_nginx_proxy() {echo "配置Nginx反向代理..."cat > /etc/nginx/sites-available/jenkins << EOF
server {listen 80;server_name jenkins.company.com;# 重定向到HTTPSreturn 301 https://\$server_name\$request_uri;
}server {listen 443 ssl http2;server_name jenkins.company.com;# SSL配置ssl_certificate /etc/ssl/certs/jenkins.company.com.crt;ssl_certificate_key /etc/ssl/private/jenkins.company.com.key;ssl_protocols TLSv1.2 TLSv1.3;ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;ssl_prefer_server_ciphers off;ssl_session_cache shared:SSL:10m;ssl_session_timeout 10m;# 安全頭add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;add_header X-Frame-Options DENY;add_header X-Content-Type-Options nosniff;add_header X-XSS-Protection "1; mode=block";add_header Referrer-Policy "strict-origin-when-cross-origin";# 代理配置location / {proxy_pass http://127.0.0.1:8080;proxy_set_header Host \$host;proxy_set_header X-Real-IP \$remote_addr;proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;proxy_set_header X-Forwarded-Proto \$scheme;proxy_set_header X-Forwarded-Port \$server_port;# WebSocket支持proxy_http_version 1.1;proxy_set_header Upgrade \$http_upgrade;proxy_set_header Connection "upgrade";# 超時設置proxy_connect_timeout 60s;proxy_send_timeout 60s;proxy_read_timeout 60s;# 緩沖設置proxy_buffering off;proxy_request_buffering off;}# 靜態資源緩存location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg)\$ {proxy_pass http://127.0.0.1:8080;proxy_set_header Host \$host;expires 1y;add_header Cache-Control "public, immutable";}
}
EOF# 啟用站點ln -sf /etc/nginx/sites-available/jenkins /etc/nginx/sites-enabled/# 測試配置nginx -t# 重載Nginxsystemctl reload nginxecho "Nginx反向代理配置完成"
}# 執行配置
generate_self_signed_cert
configure_jenkins_https
configure_nginx_proxy

防火墻配置

iptables規則：

#!/bin/bash# Jenkins防火墻配置腳本
configure_jenkins_firewall() {echo "配置Jenkins防火墻規則..."# 清空現有規則iptables -Fiptables -Xiptables -t nat -Fiptables -t nat -X# 設置默認策略iptables -P INPUT DROPiptables -P FORWARD DROPiptables -P OUTPUT ACCEPT# 允許本地回環iptables -A INPUT -i lo -j ACCEPTiptables -A OUTPUT -o lo -j ACCEPT# 允許已建立的連接iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT# 允許SSH（管理訪問）iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT# 允許HTTP/HTTPS（僅來自特定網段）iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/8 -m state --state NEW -j ACCEPTiptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -m state --state NEW -j ACCEPT# 允許Jenkins端口（僅來自內網）iptables -A INPUT -p tcp --dport 8080 -s 192.168.0.0/16 -m state --state NEW -j ACCEPTiptables -A INPUT -p tcp --dport 8443 -s 192.168.0.0/16 -m state --state NEW -j ACCEPT# 允許Jenkins代理連接（JNLP端口）iptables -A INPUT -p tcp --dport 50000 -s 192.168.0.0/16 -m state --state NEW -j ACCEPT# 限制連接頻率（防止暴力破解）iptables -A INPUT -p tcp --dport 22 -m recent --name ssh --setiptables -A INPUT -p tcp --dport 22 -m recent --name ssh --rcheck --seconds 60 --hitcount 4 -j DROPiptables -A INPUT -p tcp --dport 80 -m recent --name http --setiptables -A INPUT -p tcp --dport 80 -m recent --name http --rcheck --seconds 60 --hitcount 20 -j DROPiptables -A INPUT -p tcp --dport 443 -m recent --name https --setiptables -A INPUT -p tcp --dport 443 -m recent --name https --rcheck --seconds 60 --hitcount 20 -j DROP# 記錄被丟棄的包iptables -A INPUT -j LOG --log-prefix "IPTABLES-DROPPED: " --log-level 4iptables -A INPUT -j DROP# 保存規則iptables-save > /etc/iptables/rules.v4echo "防火墻規則配置完成"
}# UFW配置（Ubuntu）
configure_ufw() {echo "配置UFW防火墻..."# 重置UFWufw --force reset# 設置默認策略ufw default deny incomingufw default allow outgoing# 允許SSHufw allow ssh# 允許HTTP/HTTPS（限制來源）ufw allow from 10.0.0.0/8 to any port 80ufw allow from 10.0.0.0/8 to any port 443# 允許Jenkins端口ufw allow from 192.168.0.0/16 to any port 8080ufw allow from 192.168.0.0/16 to any port 8443ufw allow from 192.168.0.0/16 to any port 50000# 啟用UFWufw --force enable# 顯示狀態ufw status verboseecho "UFW防火墻配置完成"
}# 選擇防火墻類型
if command -v ufw >/dev/null 2>&1; thenconfigure_ufw
elseconfigure_jenkins_firewall
fi

網絡隔離

Docker網絡隔離：

# docker-compose.yml - Jenkins網絡隔離
version: '3.8'services:jenkins:image: jenkins/jenkins:ltscontainer_name: jenkins-masterrestart: unless-stoppednetworks:- jenkins-internal- jenkins-externalports:- "127.0.0.1:8080:8080"  # 僅綁定到本地- "127.0.0.1:50000:50000"volumes:- jenkins_home:/var/jenkins_home- /var/run/docker.sock:/var/run/docker.sockenvironment:- JAVA_OPTS=-Djenkins.install.runSetupWizard=false- JENKINS_OPTS=--httpListenAddress=0.0.0.0security_opt:- no-new-privileges:trueuser: "1000:1000"nginx:image: nginx:alpinecontainer_name: jenkins-proxyrestart: unless-stoppednetworks:- jenkins-externalports:- "80:80"- "443:443"volumes:- ./nginx.conf:/etc/nginx/nginx.conf:ro- ./ssl:/etc/ssl:rodepends_on:- jenkinssecurity_opt:- no-new-privileges:truejenkins-agent:image: jenkins/inbound-agent:latestcontainer_name: jenkins-agent-1restart: unless-stoppednetworks:- jenkins-internalenvironment:- JENKINS_URL=http://jenkins:8080- JENKINS_SECRET=${AGENT_SECRET}- JENKINS_AGENT_NAME=agent-1- JENKINS_AGENT_WORKDIR=/home/jenkins/agentvolumes:- jenkins_agent_workdir:/home/jenkins/agentdepends_on:- jenkinssecurity_opt:- no-new-privileges:trueuser: "1000:1000"networks:jenkins-internal:driver: bridgeinternal: true  # 內部網絡，無法訪問外網ipam:config:- subnet: 172.20.0.0/16jenkins-external:driver: bridgeipam:config:- subnet: 172.21.0.0/16volumes:jenkins_home:driver: localjenkins_agent_workdir:driver: local

Kubernetes網絡策略：

# jenkins-network-policy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:name: jenkins-network-policynamespace: jenkins
spec:podSelector:matchLabels:app: jenkinspolicyTypes:- Ingress- Egressingress:# 允許來自Nginx Ingress的流量- from:- namespaceSelector:matchLabels:name: ingress-nginxports:- protocol: TCPport: 8080# 允許來自Jenkins代理的連接- from:- podSelector:matchLabels:app: jenkins-agentports:- protocol: TCPport: 50000# 允許來自監控系統的連接- from:- namespaceSelector:matchLabels:name: monitoringports:- protocol: TCPport: 8080egress:# 允許訪問Kubernetes API- to: []ports:- protocol: TCPport: 443# 允許訪問Git倉庫- to: []ports:- protocol: TCPport: 22- protocol: TCPport: 443# 允許訪問Docker Registry- to: []ports:- protocol: TCPport: 443# 允許DNS解析- to: []ports:- protocol: UDPport: 53- protocol: TCPport: 53---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:name: jenkins-agent-network-policynamespace: jenkins
spec:podSelector:matchLabels:app: jenkins-agentpolicyTypes:- Ingress- Egressingress:# 拒絕所有入站流量[]egress:# 允許連接到Jenkins主節點- to:- podSelector:matchLabels:app: jenkinsports:- protocol: TCPport: 8080- protocol: TCPport: 50000# 允許訪問外部資源- to: []ports:- protocol: TCPport: 22- protocol: TCPport: 443- protocol: TCPport: 80# 允許DNS解析- to: []ports:- protocol: UDPport: 53

7.6 安全監控

審計日志

啟用審計日志：

// 配置Jenkins審計日志
import jenkins.model.Jenkins
import hudson.logging.LogRecorder
import hudson.logging.LogRecorder.Target
import java.util.logging.Leveldef jenkins = Jenkins.instance// 創建審計日志記錄器
def logRecorder = new LogRecorder("Security Audit")// 添加日志目標
def targets = [new Target("hudson.security.SecurityRealm", Level.INFO),new Target("hudson.security.AuthorizationStrategy", Level.INFO),new Target("jenkins.security.ApiTokenFilter", Level.INFO),new Target("hudson.security.csrf.CrumbFilter", Level.INFO),new Target("org.jenkinsci.plugins.scriptsecurity", Level.INFO),new Target("hudson.model.User", Level.INFO)
]targets.each { target ->logRecorder.targets.add(target)
}// 添加到Jenkins
jenkins.getLog().getRecorders().put("Security Audit", logRecorder)
jenkins.save()println "安全審計日志配置完成"

審計事件監聽器：

// 自定義審計事件監聽器
import hudson.Extension
import hudson.model.listeners.RunListener
import hudson.model.AbstractBuild
import hudson.model.TaskListener
import hudson.model.User
import jenkins.model.Jenkins
import java.util.logging.Logger
import java.util.logging.Level@Extension
class SecurityAuditListener extends RunListener<AbstractBuild> {private static final Logger LOGGER = Logger.getLogger(SecurityAuditListener.class.getName())@Overridevoid onStarted(AbstractBuild build, TaskListener listener) {def user = User.current()def project = build.getProject()def auditEvent = [timestamp: new Date(),event: "BUILD_STARTED",user: user?.getId() ?: "SYSTEM",project: project.getName(),buildNumber: build.getNumber(),node: build.getBuiltOn()?.getNodeName() ?: "master",cause: build.getCauses().collect { it.getShortDescription() }.join(", ")]LOGGER.info("AUDIT: ${auditEvent}")// 發送到外部審計系統sendToAuditSystem(auditEvent)}@Overridevoid onCompleted(AbstractBuild build, TaskListener listener) {def user = User.current()def project = build.getProject()def auditEvent = [timestamp: new Date(),event: "BUILD_COMPLETED",user: user?.getId() ?: "SYSTEM",project: project.getName(),buildNumber: build.getNumber(),result: build.getResult().toString(),duration: build.getDuration(),node: build.getBuiltOn()?.getNodeName() ?: "master"]LOGGER.info("AUDIT: ${auditEvent}")// 發送到外部審計系統sendToAuditSystem(auditEvent)}private void sendToAuditSystem(Map auditEvent) {try {// 發送到Elasticsearchdef json = new groovy.json.JsonBuilder(auditEvent).toString()def url = new URL("http://elasticsearch:9200/jenkins-audit/_doc")def connection = url.openConnection()connection.setRequestMethod("POST")connection.setRequestProperty("Content-Type", "application/json")connection.setDoOutput(true)connection.getOutputStream().write(json.getBytes("UTF-8"))def responseCode = connection.getResponseCode()if (responseCode == 201) {LOGGER.fine("審計事件已發送到Elasticsearch")} else {LOGGER.warning("發送審計事件失敗: ${responseCode}")}} catch (Exception e) {LOGGER.log(Level.WARNING, "發送審計事件異常", e)}}
}

日志分析腳本：

#!/bin/bash# Jenkins安全日志分析腳本
analyze_security_logs() {local log_file="/var/log/jenkins/jenkins.log"local output_dir="/var/log/jenkins/security-analysis"mkdir -p "$output_dir"echo "分析Jenkins安全日志..."# 分析登錄失敗echo "=== 登錄失敗分析 ===" > "$output_dir/login-failures.txt"grep -i "authentication failed\|login failed\|invalid credentials" "$log_file" | \awk '{print $1, $2, $3}' | sort | uniq -c | sort -nr >> "$output_dir/login-failures.txt"# 分析權限拒絕echo "=== 權限拒絕分析 ===" > "$output_dir/access-denied.txt"grep -i "access denied\|permission denied\|unauthorized" "$log_file" | \awk '{print $1, $2, $3}' | sort | uniq -c | sort -nr >> "$output_dir/access-denied.txt"# 分析異常IPecho "=== 異常IP分析 ===" > "$output_dir/suspicious-ips.txt"grep -oE "([0-9]{1,3}\.){3}[0-9]{1,3}" "$log_file" | \sort | uniq -c | sort -nr | head -20 >> "$output_dir/suspicious-ips.txt"# 分析腳本執行echo "=== 腳本執行分析 ===" > "$output_dir/script-execution.txt"grep -i "script\|groovy\|execute" "$log_file" | \grep -v "INFO" | head -50 >> "$output_dir/script-execution.txt"# 生成安全報告generate_security_report "$output_dir"
}generate_security_report() {local output_dir="$1"local report_file="$output_dir/security-report-$(date +%Y%m%d).html"cat > "$report_file" << EOF
<!DOCTYPE html>
<html>
<head><title>Jenkins安全分析報告</title><style>body { font-family: Arial, sans-serif; margin: 20px; }.section { margin: 20px 0; padding: 15px; border: 1px solid #ddd; }.warning { background-color: #fff3cd; border-color: #ffeaa7; }.danger { background-color: #f8d7da; border-color: #f5c6cb; }pre { background-color: #f8f9fa; padding: 10px; overflow-x: auto; }</style>
</head>
<body><h1>Jenkins安全分析報告</h1><p>生成時間: $(date)</p><div class="section warning"><h2>登錄失敗統計</h2><pre>$(cat "$output_dir/login-failures.txt")</pre></div><div class="section danger"><h2>權限拒絕事件</h2><pre>$(cat "$output_dir/access-denied.txt")</pre></div><div class="section warning"><h2>可疑IP地址</h2><pre>$(cat "$output_dir/suspicious-ips.txt")</pre></div><div class="section"><h2>腳本執行記錄</h2><pre>$(cat "$output_dir/script-execution.txt")</pre></div>
</body>
</html>
EOFecho "安全報告已生成: $report_file"
}# 執行分析
analyze_security_logs

威脅檢測

異常行為檢測：

// 異常行為檢測腳本
import jenkins.model.Jenkins
import hudson.model.User
import hudson.model.AbstractBuild
import hudson.model.Run
import java.util.concurrent.ConcurrentHashMap
import java.util.concurrent.atomic.AtomicInteger
import java.time.LocalDateTime
import java.time.temporal.ChronoUnitclass ThreatDetectionService {private static final Map<String, UserActivity> userActivities = new ConcurrentHashMap<>()private static final Map<String, AtomicInteger> ipAttempts = new ConcurrentHashMap<>()static class UserActivity {String userIdList<LocalDateTime> loginTimes = []List<String> ipAddresses = []List<String> projects = []int failedLogins = 0LocalDateTime lastActivityUserActivity(String userId) {this.userId = userIdthis.lastActivity = LocalDateTime.now()}}// 檢測暴力破解攻擊static boolean detectBruteForce(String userId, String ipAddress) {def activity = userActivities.computeIfAbsent(userId, { new UserActivity(it) })// 檢查失敗登錄次數if (activity.failedLogins > 5) {def lastFailTime = activity.lastActivitydef timeDiff = ChronoUnit.MINUTES.between(lastFailTime, LocalDateTime.now())if (timeDiff < 30) {sendAlert("暴力破解檢測", "用戶 ${userId} 在30分鐘內失敗登錄超過5次")return true}}// 檢查IP地址嘗試次數def attempts = ipAttempts.computeIfAbsent(ipAddress, { new AtomicInteger(0) })if (attempts.incrementAndGet() > 10) {sendAlert("IP暴力破解檢測", "IP地址 ${ipAddress} 嘗試登錄超過10次")return true}return false}// 檢測異常登錄時間static boolean detectAbnormalLoginTime(String userId) {def activity = userActivities.get(userId)if (activity == null) return falsedef now = LocalDateTime.now()def hour = now.getHour()// 檢測非工作時間登錄（晚上10點到早上6點）if (hour >= 22 || hour <= 6) {sendAlert("異常登錄時間", "用戶 ${userId} 在非工作時間 ${now} 登錄")return true}return false}// 檢測異常地理位置static boolean detectAbnormalLocation(String userId, String ipAddress) {def activity = userActivities.get(userId)if (activity == null) return false// 檢查IP地址變化if (!activity.ipAddresses.contains(ipAddress)) {activity.ipAddresses.add(ipAddress)// 如果用戶從新的IP地址登錄if (activity.ipAddresses.size() > 1) {def location = getLocationByIP(ipAddress)sendAlert("異常登錄位置", "用戶 ${userId} 從新位置 ${location} (${ipAddress}) 登錄")return true}}return false}// 檢測權限提升static boolean detectPrivilegeEscalation(String userId, String action) {def dangerousActions = ["ADMINISTER","MANAGE_PLUGINS","CONFIGURE_UPDATECENTER","RUN_SCRIPTS","MANAGE_CREDENTIALS"]if (dangerousActions.contains(action)) {def user = User.getById(userId, false)if (user != null) {// 檢查用戶是否應該有這些權限def hasPermission = Jenkins.instance.hasPermission(user, Jenkins.ADMINISTER)if (!hasPermission) {sendAlert("權限提升檢測", "用戶 ${userId} 嘗試執行高權限操作: ${action}")return true}}}return false}// 檢測異常構建行為static boolean detectAbnormalBuildBehavior(String userId, String projectName) {def activity = userActivities.computeIfAbsent(userId, { new UserActivity(it) })// 檢查項目訪問模式if (!activity.projects.contains(projectName)) {activity.projects.add(projectName)// 如果用戶訪問了太多不同的項目if (activity.projects.size() > 20) {sendAlert("異常項目訪問", "用戶 ${userId} 訪問了過多項目 (${activity.projects.size()})")return true}}return false}// 發送安全警報static void sendAlert(String type, String message) {def alertData = [timestamp: LocalDateTime.now(),type: type,message: message,severity: "HIGH"]// 記錄到日志def logger = java.util.logging.Logger.getLogger("SECURITY_ALERT")logger.warning("SECURITY_ALERT: ${alertData}")// 發送到監控系統sendToMonitoringSystem(alertData)// 發送郵件通知sendEmailAlert(alertData)}static void sendToMonitoringSystem(Map alertData) {// 發送到Prometheus/Grafanatry {def json = new groovy.json.JsonBuilder(alertData).toString()// 實現發送邏輯} catch (Exception e) {println "發送監控數據失敗: ${e.message}"}}static void sendEmailAlert(Map alertData) {// 發送郵件警報try {def mailSender = Jenkins.instance.getDescriptor("hudson.tasks.Mailer")// 實現郵件發送邏輯} catch (Exception e) {println "發送郵件警報失敗: ${e.message}"}}static String getLocationByIP(String ipAddress) {// 簡單的IP地理位置查詢try {def url = new URL("http://ip-api.com/json/${ipAddress}")def response = url.textdef json = new groovy.json.JsonSlurper().parseText(response)return "${json.city}, ${json.country}"} catch (Exception e) {return "未知位置"}}
}// 使用示例
def userId = "testuser"
def ipAddress = "192.168.1.100"// 檢測各種威脅
ThreatDetectionService.detectBruteForce(userId, ipAddress)
ThreatDetectionService.detectAbnormalLoginTime(userId)
ThreatDetectionService.detectAbnormalLocation(userId, ipAddress)
ThreatDetectionService.detectPrivilegeEscalation(userId, "ADMINISTER")
ThreatDetectionService.detectAbnormalBuildBehavior(userId, "sensitive-project")

安全監控儀表板

Grafana儀表板配置：

{"dashboard": {"id": null,"title": "Jenkins安全監控","tags": ["jenkins", "security"],"timezone": "browser","panels": [{"id": 1,"title": "登錄失敗次數","type": "stat","targets": [{"expr": "increase(jenkins_login_failures_total[1h])","legendFormat": "登錄失敗"}],"fieldConfig": {"defaults": {"color": {"mode": "thresholds"},"thresholds": {"steps": [{"color": "green", "value": null},{"color": "yellow", "value": 5},{"color": "red", "value": 10}]}}}},{"id": 2,"title": "權限拒絕事件","type": "timeseries","targets": [{"expr": "rate(jenkins_access_denied_total[5m])","legendFormat": "權限拒絕/分鐘"}]},{"id": 3,"title": "活躍用戶","type": "table","targets": [{"expr": "jenkins_active_users","format": "table"}]},{"id": 4,"title": "安全警報","type": "logs","targets": [{"expr": "{job=\"jenkins\"} |= \"SECURITY_ALERT\""}]}],"time": {"from": "now-1h","to": "now"},"refresh": "30s"}
}

7.7 安全最佳實踐

安全配置檢查清單

基礎安全配置：

□ 啟用全局安全配置
□ 配置強密碼策略
□ 啟用CSRF保護
□ 配置適當的授權策略
□ 禁用不必要的功能
□ 定期更新Jenkins和插件
□ 配置安全的網絡訪問
□ 啟用HTTPS
□ 配置防火墻規則
□ 設置會話超時身份認證：
□ 使用企業級認證系統（LDAP/AD）
□ 啟用多因素認證
□ 配置單點登錄（SSO）
□ 定期審查用戶賬戶
□ 禁用匿名訪問
□ 設置賬戶鎖定策略訪問控制：
□ 實施最小權限原則
□ 使用基于角色的訪問控制
□ 配置項目級權限
□ 定期審查權限分配
□ 使用文件夾組織項目
□ 限制管理員權限憑據管理：
□ 使用Jenkins憑據存儲
□ 啟用憑據加密
□ 定期輪換憑據
□ 使用憑據域隔離
□ 避免在腳本中硬編碼憑據
□ 監控憑據使用情況網絡安全：
□ 配置HTTPS/TLS
□ 使用強加密算法
□ 配置網絡隔離
□ 實施網絡訪問控制
□ 使用VPN或專線
□ 監控網絡流量監控和審計：
□ 啟用審計日志
□ 配置安全監控
□ 設置安全警報
□ 定期安全評估
□ 實施威脅檢測
□ 建立事件響應流程

安全運維流程

日常安全檢查：

#!/bin/bash# Jenkins日常安全檢查腳本
daily_security_check() {echo "開始Jenkins日常安全檢查..."# 檢查Jenkins版本check_jenkins_version# 檢查插件更新check_plugin_updates# 檢查用戶賬戶check_user_accounts# 檢查權限配置check_permissions# 檢查憑據安全check_credentials# 檢查網絡配置check_network_config# 檢查日志異常check_log_anomalies# 生成安全報告generate_daily_report
}check_jenkins_version() {echo "檢查Jenkins版本..."local current_version=$(curl -s http://localhost:8080/api/json | jq -r '.version')local latest_version=$(curl -s https://api.github.com/repos/jenkinsci/jenkins/releases/latest | jq -r '.tag_name')if [ "$current_version" != "$latest_version" ]; thenecho "警告: Jenkins版本過舊 (當前: $current_version, 最新: $latest_version)"elseecho "Jenkins版本正常"fi
}check_plugin_updates() {echo "檢查插件更新..."# 獲取有更新的插件列表local updates=$(curl -s "http://localhost:8080/pluginManager/api/json?depth=1" | \jq -r '.plugins[] | select(.hasUpdate == true) | .shortName')if [ -n "$updates" ]; thenecho "發現插件更新:"echo "$updates"elseecho "所有插件都是最新版本"fi
}check_user_accounts() {echo "檢查用戶賬戶..."# 檢查長期未登錄的用戶local inactive_users=$(curl -s "http://localhost:8080/asynchPeople/api/json" | \jq -r '.users[] | select(.lastChange < (now - 2592000)) | .user.fullName')if [ -n "$inactive_users" ]; thenecho "發現長期未登錄用戶:"echo "$inactive_users"fi# 檢查管理員賬戶local admin_count=$(curl -s "http://localhost:8080/whoAmI/api/json" | \jq -r '.authorities[] | select(. == "hudson.model.Hudson.Administer")' | wc -l)if [ "$admin_count" -gt 3 ]; thenecho "警告: 管理員賬戶過多 ($admin_count)"fi
}check_permissions() {echo "檢查權限配置..."# 檢查匿名訪問local anonymous_read=$(curl -s "http://localhost:8080/api/json" | \jq -r '.useSecurity')if [ "$anonymous_read" = "false" ]; thenecho "警告: 可能啟用了匿名訪問"fi
}check_credentials() {echo "檢查憑據安全..."# 檢查憑據數量local cred_count=$(curl -s "http://localhost:8080/credentials/api/json" | \jq -r '.credentials | length')echo "當前憑據數量: $cred_count"# 檢查過期憑據（需要自定義邏輯）# ...
}check_network_config() {echo "檢查網絡配置..."# 檢查HTTPS配置if curl -s -k https://localhost:8443 >/dev/null 2>&1; thenecho "HTTPS配置正常"elseecho "警告: HTTPS配置可能有問題"fi# 檢查防火墻規則if command -v iptables >/dev/null 2>&1; thenlocal open_ports=$(iptables -L INPUT -n | grep ACCEPT | grep -E "dpt:(8080|8443|50000)")if [ -n "$open_ports" ]; thenecho "檢測到開放的Jenkins端口"fifi
}check_log_anomalies() {echo "檢查日志異常..."local log_file="/var/log/jenkins/jenkins.log"# 檢查錯誤日志local error_count=$(grep -c "ERROR" "$log_file" 2>/dev/null || echo 0)if [ "$error_count" -gt 10 ]; thenecho "警告: 發現大量錯誤日志 ($error_count)"fi# 檢查安全相關日志local security_events=$(grep -c -i "security\|authentication\|authorization" "$log_file" 2>/dev/null || echo 0)echo "安全相關事件: $security_events"
}generate_daily_report() {echo "生成日常安全報告..."local report_file="/var/log/jenkins/security-check-$(date +%Y%m%d).txt"{echo "Jenkins日常安全檢查報告"echo "檢查時間: $(date)"echo "==========================================="echo# 這里可以添加更詳細的報告內容} > "$report_file"echo "報告已生成: $report_file"
}# 執行日常檢查
daily_security_check