How do I enable security for Jenkins JNLP slaves?

Question

This seems like an obvious question, but I've looked high and low and can't find an answer. Here's the situation:

1. I am running a Jenkins continuous integration server on the public Internet with (trusted) volunteers running slaves on a mixture of Windows and Linux machines
2. We are using the JNLP (Web start) doodad to start slaves to avoid firewall issues and setting up/debugging ssh
3. The server is set up with Matrix-Based security

The trouble is, I can find exactly zero information on how security works with JNLP. If any anonymous read permissions are granted, then anyone in the world can download slave.jar and access the jnlp file at the (easy to guess) URLS on my server, and connect as a slave.

I discovered that if I revoke all anonymous access, the jnlp file is blocked but slave.jar is still accessible.

There doesn't seem to be anything particularly secure in the jnlp file, except one long hex number. Is this setup safe or is there something else I have to do?

It would be nice if visitors could see the recent builds without logging in, but again if I grant read permissions to anonymous, anyone can access the jnlp file.

Answer 1

If any anonymous read permissions are granted, then anyone in the world can download slave.jar and access the jnlp file at the (easy to guess) URLS on my server, and connect as a slave.

It turns out that this was actually a critical security vulnerability in Jenkins:

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04

In answer to my question, it seems the best approach is to disable all anonymous read access.

Answer 2

From the comments on this jenkins bug it seems that this behaviour (allowing anyone with read permissions to see the jnlp file) was changed in the course of fixing the security vulnerability, and you can now limit access to the jnlp file to particular users.

I couldn't find any documentation on the current behaviour either, but it's possible to get some clues by

1. Revoking all permissions for "anynmous"
2. Attempting to download the jnlp file without providing any credentials, using wget or similar

Step 2. will give a "403 forbidden" response which contains a something like

Authentication required
<!--
You are authenticated as: anonymous
Groups that you are in:

Permission you need to have (but didn't): hudson.model.Computer.Connect
 ... which is implied by: hudson.model.Computer.Disconnect
 ... which is implied by: hudson.model.Hudson.Administer
-->

The response also contains a javascript redirect, so you need to use wget or some other non-javascript-enabled method to be able to see it.

By trial and error, I found that "hudson.model.Computer.Connect" seems to map to the "Slave Connect" permission in the Jenkins UI.