{"id":1266,"date":"2012-10-10T22:03:47","date_gmt":"2012-10-11T02:03:47","guid":{"rendered":"https:\/\/lowtek.ca\/roo\/?p=1266"},"modified":"2012-10-10T22:03:47","modified_gmt":"2012-10-11T02:03:47","slug":"how-to-jenkins-with-apache-controlled-authentication","status":"publish","type":"post","link":"https:\/\/lowtek.ca\/roo\/2012\/how-to-jenkins-with-apache-controlled-authentication\/","title":{"rendered":"How To: Jenkins with Apache controlled authentication"},"content":{"rendered":"

\"\"<\/a><\/p>\n

For a change of pace, I was working with RHEL6<\/a> instead of Ubuntu<\/a> and setting up a Jenkins CI<\/a> server. I’ve used Jenkins aka Hudson<\/a> previously, but this was my first time setting it up.<\/p>\n

A lot of this is straight from the Jenkins wiki<\/a>, which is detailed and helpful but at times cryptic. The default access mode of Jenkins is pretty much wide open, this is very handy for getting things done – but probably not what you want if there are a mix of people on the network, many whom you really don’t want to let do stuff like launch\/configure your builds. As I had Apache<\/a> already running and setting up authentication with Apache is relatively straight-forward, I figured the easy solution would be to hide Jenkins behind Apache.<\/p>\n

Since Jenkins is a big wad of Java code that is offering up a web interface, we’ve effectively got two web servers running: Apache, and Jenkins (different ports). The solution we’ll use is a proxy on the Apache side and some firewall rules to prevent direct access to Jenkins, forcing people through the proxy and thus the authentication controlled by Apache.<\/p>\n

Let’s start by checking to see if mod proxy is enabled. This is simply a matter of verifying if \/etc\/httpd\/conf\/httpd.conf<\/code> has these two lines:<\/p>\n

LoadModule proxy_module modules\/mod_proxy.so
\nLoadModule proxy_http_module modules\/mod_proxy_http.so<\/code><\/p>\n

In my case it was enabled so no work needed. Now we modify \/etc\/sysconfig\/jenkins<\/code>, at the end of the file we need to add some args to point at the path we want our Jenkins instance to be hosted at:<\/p>\n

JENKINS_ARGS=\"--prefix=\/jenkins\" <\/code><\/p>\n

Restart Jenkins (service jenkins restart<\/code>) to have the changes picked up. You can test to see if it’s working on localhost:8080\/jenkins<\/code>. I tried, and failed to have this work for a nested path (ie: \/path\/to\/jenkins), I suspect this is a Jenkins limitation but didn’t chase down the actual reason.<\/p>\n

Next let’s create an Apache configuration file in \/etc\/httpd\/conf.d\/jenkins_proxy.conf<\/code> with the following contents:<\/p>\n

ProxyPass \/jenkins http:\/\/localhost:8080\/jenkins
\nProxyPassReverse \/jenkins http:\/\/localhost:8080\/jenkins
\nProxyRequests Off <\/code><\/p>\n

# Local reverse proxy authorization override
\n# Most unix distribution deny proxy by default (ie \/etc\/apache2\/mods-enabled\/proxy.conf in Ubuntu)
\nOrder deny,allow
\nAllow from all<\/code><\/p>\n

We need to restart the web server (service httpd restart<\/code>)\u00a0to have these changes picked up. As this is RHEL6 and it is running with SELinux<\/a> enabled, we also need to allow httpd (Apache) to do proxy connections:<\/p>\n

# setsebool -P httpd_can_network_connect true<\/code><\/p>\n

Now\u00a0at this point you should be able to visit http:\/\/yoursite.com\/jenkins, and see that our proxy configuration is working. This is cool, but people can still talk to it via http:\/\/yoursite.com:8080\/jenkins which will bypass Apache.<\/p>\n

We’ll be using iptables<\/a>\u00a0to accomplish this. As you can see my system was running iptables, but everything was permitted.<\/p>\n

# iptables -L
\nChain INPUT (policy ACCEPT)
\ntarget prot opt source destination
\nACCEPT all -- anywhere anywhere
\n<\/code>
\nChain FORWARD (policy ACCEPT)
\ntarget prot opt source destination<\/code><\/p>\n

Chain OUTPUT (policy ACCEPT)
\ntarget prot opt source destination<\/code><\/p>\n

Use ifconfig<\/code> to figure out what your ethernet card is (the one where external packets will come from), in my case it was eth6<\/code>.\u00a0So we can simply instruct iptables to drop packets destined to 8080 from that source, allowing only internal traffic (ie: the proxy) to pass.<\/p>\n

# iptables -A INPUT -p tcp -i eth6 --dport 8080 -j DROP<\/code><\/p>\n

That’s it, now users are forced to come in the correct front door (Apache). To make the iptables change permanent:<\/p>\n

#service iptables save<\/code><\/p>\n

So now the Apache web server is seeing traffic to Jenkins and can perform authentication, this is simple enough to add<\/a>\u00a0to the Apache configuration file we created that defined the proxy (\/etc\/httpd\/conf.d\/jenkins_proxy.conf<\/code>) – I’ll leave that one up to the reader to sort out.<\/p>\n","protected":false},"excerpt":{"rendered":"

For a change of pace, I was working with RHEL6 instead of Ubuntu and setting up a Jenkins CI server. I’ve used Jenkins aka Hudson previously, but this was my first time setting it up. A lot of this is straight from the Jenkins wiki, which is detailed and helpful but at times cryptic. The … Continue reading “How To: Jenkins with Apache controlled authentication”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,12],"tags":[],"class_list":["post-1266","post","type-post","status-publish","format-standard","hentry","category-computing","category-how-to"],"_links":{"self":[{"href":"https:\/\/lowtek.ca\/roo\/wp-json\/wp\/v2\/posts\/1266","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lowtek.ca\/roo\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lowtek.ca\/roo\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lowtek.ca\/roo\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lowtek.ca\/roo\/wp-json\/wp\/v2\/comments?post=1266"}],"version-history":[{"count":4,"href":"https:\/\/lowtek.ca\/roo\/wp-json\/wp\/v2\/posts\/1266\/revisions"}],"predecessor-version":[{"id":1271,"href":"https:\/\/lowtek.ca\/roo\/wp-json\/wp\/v2\/posts\/1266\/revisions\/1271"}],"wp:attachment":[{"href":"https:\/\/lowtek.ca\/roo\/wp-json\/wp\/v2\/media?parent=1266"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lowtek.ca\/roo\/wp-json\/wp\/v2\/categories?post=1266"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lowtek.ca\/roo\/wp-json\/wp\/v2\/tags?post=1266"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}