Where Jenkins stores SVN credentials

Question

Started to play around with Jenkins. Created new job and entered SVN repository URL. Pressed build and jenkins successfully checked-out my repository. My repository has not got anonymous access. No clue, how Jenkins managed to checked-out repository.

Running on Windows XP + Tomcat6 + Jenkins war file.

Probably Jenkins managed to read password from system properties ? Right now trying to find this configuration file, where it store password-s or settings

UPDATE

Not sure, but looks like, Jenkins read SVN credentials from tortoise svn cache. When i cleaned cache, can't access repository anymore from Jenkins

Answer 1

Indeed, it takes it from Subversion cache. At least, right now I know, that it's not good idea, to save passwords

Subversion will look in the $HOME/.subversion file for credentials, but it also stores the password under each job in a file called subversion.credentials.

Usually, your Jenkins machine isn't accessible to mere mortals and you can make the Jenkins $HOME directory owned by another user. This way, you can use your OS's security features to prevent people from peeking in at your Jenkins credentials.

Another possibility is to make the Subversion checkout user for Jenkins a read-only user. That will allow Jenkins to checkout the code, but if someone snags the Jenkins Subversion account, they won't be able to make changes.

If you also use Jenkins to tag your Subversion builds, you can use a pre-commit hook to allow Jenkins to create a tag, but not be able to do anything else.

That should ease your security concerns. If you think about it, Jenkins has to be able to store its subversion account and password, or else it won't be able to automatically checkout the code for a build.

Answer 2

credentials.xml, in default, it's under ~/.jenkins/

Answer 3

Indeed, it takes it from Subversion cache. At least, right now I know, that it's not good idea, to save passwords