100 votes
Accepted

How to decrypt Jenkins passwords from credentials.xml?

Luckily there is a hudson.util.Secret.decrypt() function which can be used for this, so: In Jenkins, go to: /script page. Run the following command: println(hudson.util.Secret.decrypt("{XXX=}")) or:...
user avatar
  • 7,121
22 votes

How to decrypt Jenkins passwords from credentials.xml?

Here is a short snippet you can just run from the jenkins script console, to dump all of your credentials to plain text. com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance()....
user avatar
  • 321
9 votes
Accepted

Git Files Encryption for Business

There really is no way to take on your problem with git, which is to deny a developer with access to the code (required to work with it) the possibility to steal the code. This is because as soon as ...
user avatar
  • 4,716
7 votes
Accepted

How to storing encrypted secrets in code for a serverless.com project?

There are a couple of elements to consider here: It is valuable to have the capability to maintain configuration with a separate release cadence from the code that is being configured. Doing so ...
user avatar
7 votes

How to decrypt Jenkins passwords from credentials.xml?

Based on Magnus' answer but as a simple oneliner with still readable output: com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{println it.dump()....
6 votes
Accepted

Is Azure's confidential computing essentially encrypted RAM?

The article you are referencing mentions encrypted RAM but that was only a reference to possibilities of enhancing the technology more in the future, not about the current state of confidential ...
user avatar
  • 525
5 votes
Accepted

When your micro service in production needs a secret, where is the secret stored and retrieved from?

Short answer Ideally, you should store secrets as environment variables, and retrieve them from a secrets management system like Hashicorp's Vault or AWS Parameter store. Long answer I saw your ...
user avatar
  • 1,332
4 votes

How to decrypt Jenkins passwords from credentials.xml?

@kenorb example with hudson.util.Secret is good. Also answers listing all credentials are very useful (thanks @ymajoros for one-liner). These do not handle secret files though where secretBytes are ...
user avatar
3 votes
Accepted

Vault `SSH-CA` Elliptic Curve rather than `RSA`

I think the answer should be yes to ecdsa but no to ed25519, but that it is currently no to both. You can externally generate an ecdsa keypair and load it into ssh/config/ca but vault-1.4.3 cannot ...
user avatar
3 votes
Accepted

How do I use only an encrypted version of my AWS RDS password in my terraform code?

If I am understanding your question correctly, what you are describing sounds like a perfect use case for SSM. You can store your RDS password as a secure string parameter encrypted by KMS, then ...
user avatar
  • 2,993
3 votes

How to decrypt Jenkins passwords from credentials.xml?

For the record, The following snippet to be pasted into the console also does the job : def creds = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials( com.cloudbees.plugins....
user avatar
  • 161
2 votes

Encrypting docker images (end to end); transporting over offline channels

Google Container Registry is a potential option. Registry is private Image layers are stored on a Google Cloud Storage bucket, which is encrypted by Google (RSA) and can be additionally encrypted ...
user avatar
  • 121
2 votes
Accepted

How can I get a list of encrypted disks for instances that are running on the AWS CLI?

Here is what I ended up using. Enjoy. for instance in $instances; do count=`aws ec2 describe-volumes --filters Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --...
user avatar
  • 1,083
2 votes
Accepted

What is the simplest way to list which attached disks are encrypted (and which not) on AWS?

To get the number of non encrypted volumes you can run this command: aws ec2 describe-volumes --region <your_region> --filter "Name=encrypted,Values=false" --query "length(Volumes[])" length ...
user avatar
  • 11.1k
2 votes
Accepted

What options are available to encrypt the content of git repositories?

I personally am a fan of Mozilla SOps, we've introduced it to two teams and it's gone down well both times, it has proven easy to implement both with local development and our CI/CD pipelines. It has ...
user avatar
2 votes

How do you change a secret that half of your production applications use right now?

This question ties in heavily with your other question with where the secrets are set and where they retrieved from. I assume your question is asking about 'canary deployments' where you change the ...
user avatar
  • 1,332
1 vote

How to ensure data protection on remote server?

First of all, all data you can compile can be decompiled if you really want its a question about time, so you are correct here. I did not know where in the world you are, but I will recommend AWS, ...
user avatar
1 vote

What are the real world benefits of RDS instance (at rest) encryption?

This is a defense in depth tactic. There are other defense mechanisms in place at AWS to prevent data leakage such as disk destruction on disposal or limiting access to data centers to approved ...
user avatar
  • 594
1 vote

How do I setup an OpenShift route that will allow both 80 and 443 traffic to my app?

You'll want to be sure your spec.tls section has the following two items to tell the router you want both secure and insecure traffic allowed in the edge. apiVersion: route.openshift.io/v1 kind: ...
user avatar
  • 273
1 vote

How to create unique GPG Keys for different environments / projects

If you want to create separate key pairs that are not dependent on your personal keys, the easiest way is to use a separate GPG home directory for each. For example, to create keys for "projectB", ...
user avatar
1 vote

How to check accepted cipher suites by an Azure App Service?

Not sure if this is the right answer but let me give it a try with the limited knowledge i have on this. these are the resources that I found when I am looking up for tls enabling for my app service. ...
user avatar
1 vote
Accepted

Securely saving AZURE_STORAGE_KEY and storage account name in Linux systems

Instead of storing them as variables in the bash script themselves, can you store them as environment variables on the system from which the bash script is executing? This is a pretty common practice ...
user avatar
  • 2,993
1 vote

How do you know which secrets and credentials of your production services were used, and by whom/what?

The short answer: you would need to use a secret management system that provides 'audit logs'. There are many options for handling secrets out there, but unless the tool you use has audit logging, ...
user avatar
  • 1,332
1 vote

Is Azure's confidential computing essentially encrypted RAM?

Azure's Confidential Computing leverages Intel® SGX to enable applications run code inside secure enclaves. Intel Software Gaurd Extensions (SGX) use a Memory Encryption Engine that encrypts any ...
user avatar
  • 11
1 vote

How to storing encrypted secrets in code for a serverless.com project?

I typically treat secrets as configuration data in scope. As such, it does not live alongside the code as they are handled by different release schedules and processes. A separate git repo, KMS, ...
user avatar
  • 109
1 vote

How can I get a list of encrypted disks for instances that are running on the AWS CLI?

I'm not sure if you can do this without a loop. But you should be able to run the below in bash and get the right output: instances=`aws ec2 describe-instances --region us-east-1 --filters Name=...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible