Table of contents

Securing CloudBees Core on Traditional Platforms


Securing CloudBees Core on Traditional Platforms

Configuring Network Requirements

CloudBees Core’s components (the Client Master and Operations Center server) run services that require network communication over several configurable ports. You should open ports according to the services you plan to use.

Defining Inbound (Listening) Ports

Each CloudBees Core component listens for connections on the ports listed below. Many of these ports are used for optional services and can be disabled or enabled according to your needs.

Default Port Example Port 1 Service Configure Description Reference

8080

80

HTTP

Specify the command line option
--httpPort=$HTTP_PORT, where $HTTP_PORT is the new value of this HTTP listening port.
(Specify the value -1 to disable this port.)

When leveraging the built-in Jetty servlet container, a CloudBees Core component defaults to listening on port 8080 for the component’s web application.

Starting and Accessing Jenkins from jenkins-ci.org

Disabled

443

HTTPS

Specify the command line option
--httpsPort=$HTTP_PORT, where $HTTP_PORT is the new value of this HTTPS listening port.
(Specify the value -1 to disable this port.)

When leveraging the built-in servlet container, a CloudBees Core component can optionally respond over HTTPS.

Starting and Accessing Jenkins from jenkins-ci.org

Disabled or
50000

50000

JNLP

In the CloudBees Core component UI, navigate to:
Manage Jenkins  Configure Global Security  TCP port for JNLP agents

A CloudBees Core component exposes a port for agents to connect via the Java Network Launch Protocol (JNLP). It is also the primary port used by the Jenkins CLI.

Operations Center uses this port for Client Master connectivity.

Distributed Builds from jenkins-ci.org

Random

2222

SSH

In the CloudBees Core component UI, navigate to:
Manage Jenkins  Configure System  SSH Server  SSHD Port

A CloudBees Core component runs an SSH server, exposing a subset of CLI commands and allowing plugins to add functionality over SSH.

A CloudBees Core component optionally uses the SSH port for the Validated Merge plugin.

Jenkins SSH from jenkins-ci.org

33848/udp

UDP

Specify the command line option
-Dhudson.udp=$UDP_PORT, where $UDP_PORT is the new value of this UDP listening port.
(Specify the value -1 to disable this port.)

Allows a CloudBees Core component to be auto-discovered using UDP multicast.

Auto-discovering Jenkins on the network from jenkins-ci.org

5353

DNS

Specify the command line option
-Dhudson.DNSMultiCast.\ disabled=true.

Allows a CloudBees Core component to be auto-discovered using DNS Multicast.

Auto-discovering Jenkins on the network from jenkins-ci.org

9200

HTTP

In the CloudBees Core component UI, navigate to:
Manage Jenkins  Configure Analytics  Analytics  Elasticsearch Configuration  HTTP Port

Operations Center's Jenkins Analytics can optionally use an embedded Elasticsearch server.

The Elasticsearch http.port setting. This is an unauthenticated HTTP port, so be careful to ensure it is not exposed to untrusted access.

CloudBees Jenkins Analytics from cloudbees.com

9300

TCP

In the CloudBees Core component UI, navigate to:
Manage Jenkins  Configure Analytics  Analytics  Elasticsearch Configuration  Native Port

Operations Center's Analytics can optionally use an embedded Elasticsearch server.

The Elasticsearch transport.tcp.port setting. This is the bind port for the native Elasticsearch transport client.

CloudBees Jenkins Analytics from cloudbees.com

Additional plugins or even your build jobs could run services that open additional ports. Further, running a CloudBees Core component in other Java web containers, Tomcat for example, could open other, container-specific ports.

1 - ports less than 1024 on Linux based systems require a CloudBees Core component to run as root which is not recommended. The Example port column shows examples of how you might configure a CloudBees Core component to appear when fronted by a reverse proxy.

Defining Outbound Ports

For some features, a CloudBees Core component requires outbound access to services on ports as laid out below. Because these are outbound ports which could change, the following table describes the standard ports but your network may run these services on different ports and may require additional configuration.

Standard Port Service Configure Description Reference

25

SMTP

In the CloudBees Core component UI, navigate to:
Manage Jenkins  Configure System  E-mail Notification  SMTP Port

For sending emails from build failures or via other plugins' email functionality, a CloudBees Core component needs access to an SMTP server.

GMail from jenkins-ci.org

389 (636)

LDAP (LDAPS)

In the CloudBees Core component UI, navigate to:
Manage Jenkins  Configure Global Security  Access Control  Security Realm  LDAP  Server

If you plan to authenticate a CloudBees Core component user via an LDAP server, the CloudBees Core component will need access to the LDAP or LDAPS port. When accessing Microsoft Active Directory server, design for access to the Active Directory-specific ports, eg: 3268 for the Global Catalog.

LDAP Plugin from jenkins-ci.org

9200

HTTPS

In the CloudBees Core component UI, navigate to:
Manage Jenkins  Configure Analytics  Analytics  Elasticsearch Configuration  Elasticsearch URLs

Operations Center's CloudBees Analytics can optionally use an external Elasticsearch instance. If so, Operations Center will need access to this service on the HTTP port.

CloudBees Jenkins Analytics from cloudbees.com

The CloudBees Core component will require access to additional outbound ports based on the requirements of your jobs and additional plugins you configure.

Setting a Proxy Configuration

If your network uses a web proxy, you will need to configure a CloudBees Core component to enable access to services outside the network. This is important for access to external services, such as the plugin update site or external source control systems, but is not required for the CloudBees Core component to run. You may also need to set some hosts on the network to bypass the proxy, for example your internally resolved binary artifact repository.

Some plugins rely on proxy settings in different locations, so it is best to set each:

Setting Location Examples Reference

In the CloudBees Core component UI, navigate to:
Manage Jenkins  Manage Plugins  Advanced  Proxy

  • Plugin Update Center (core)

  • Git Client Plugin

Jenkins Behind Proxy from jenkins-ci.org

  • http.proxyHost, http.proxyPort, http.nonProxyHosts

  • https.proxyHost, https.proxyPort, and https.nonProxyHosts

  • Twitter Plugin

Jenkins Behind Proxy from jenkins-ci.org

Plugin Specific Proxy Settings

  • Subversion SCM Plugin

  • Rally Plugin

Jenkins Behind Proxy from jenkins-ci.org

2 - These properties should automatically default to the corresponding environment variables (http_proxy, no_proxy), but some Java distributions do not support this default.