Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I don't want to run Jenkins as root, nor giving public access (or even group access) to /etc/shadow seems to a good idea.

as suggested by "Manage Jenkins" when selecting Linux user/group database: "Either Jenkins needs to run as root or User 'httpd' needs to belong to group root and 'chmod g+r /etc/shadow' needs to be done to enable Jenkins to read /etc/shadow"

From a security stand point what would be the best practice while running Jenkins and still being able to perform some tasks as a super user (in case my jobs need that)

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

A better practice would be to use the pwauth plugin, which lets you run jenkins as a non-root user, and only pwauth itself needs to be setuid root to perform the actual authentication.

share|improve this answer
    
Thanks! The only 2 things I needed to do besides installing the pwauth plugin was making sure I had the package for it installed on my ArchLinux server and making sure the paths under Advanced Path Configuration were correct. –  MauricioOtta May 24 '13 at 7:18
    
Leaving this to help others: yaourt pwauth usermod -a -G pwauth jenkins –  MauricioOtta Jun 28 '13 at 7:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.