Re:Life Is About to Get Harder for Websites Without HTTPS
by zimbatm on Wednesday July 12, 2017 @07:02AM
(#14751504)
Google is moving away from network-centric security and VPNs. See https://cloud.google.com/beyondcorp/ . The threat model is a bit different but you could also follow their approach and put an auth proxy in front of Jenkins and deploy it on the public Internet.
But yeah, don't expose Jenkins to the Internet directly. Last month I saw a Jenkins instance that was mining bitcoins. The worm had used one of Java's serialisation vuln to get in the box and install the miner.
Re:Life Is About to Get Harder for Websites Without HTTPS
by zimbatm on Wednesday July 12, 2017 @08:16AM
(#14751836)
Not at all, it means the proxy can be attacked over the Internet. Just like the VPN can be attacked over the Internet. Once you're past that it's the same story.
But yeah, don't expose Jenkins to the Internet directly. Last month I saw a Jenkins instance that was mining bitcoins. The worm had used one of Java's serialisation vuln to get in the box and install the miner.