80

Luckily there is a hudson.util.Secret.decrypt() function which can be used for this, so: In Jenkins, go to: /script page. Run the following command: println(hudson.util.Secret.decrypt("{XXX=}")) or: println(hudson.util.Secret.fromString("{XXX=}").getPlainText()) where {XXX=} is your encrypted password. This will print the plain password. To do opposite,...


15

Here is a short snippet you can just run from the jenkins script console, to dump all of your credentials to plain text. com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{ it.properties.each { prop, val -> if (prop == "secretBytes") { println(prop + "=>\n" + new String(com.cloudbees.plugins....


9

There really is no way to take on your problem with git, which is to deny a developer with access to the code (required to work with it) the possibility to steal the code. This is because as soon as your developer has the code in a readable format (to program on it), he can do with it whatever he wants, anyways. git-crypt has a totally different use, and is ...


7

There are a couple of elements to consider here: It is valuable to have the capability to maintain configuration with a separate release cadence from the code that is being configured. Doing so encourages rotation of credentials in an automated manner, do it regularly make it painless. It is entirely reasonable from an "Infrastructure as Code" point of ...


6

The article you are referencing mentions encrypted RAM but that was only a reference to possibilities of enhancing the technology more in the future, not about the current state of confidential computing. Confidential computing means, that when data is in use these things are prevented: Malicious insiders with administrative privilege or direct access to ...


5

Short answer Ideally, you should store secrets as environment variables, and retrieve them from a secrets management system like Hashicorp's Vault or AWS Parameter store. Long answer I saw your questions out of turn, and kinda touched on this in your other question: Again, there are many perfectly valid options for handling secrets: Chef vault, ...


4

Based on Magnus' answer but as a simple oneliner with still readable output: com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{println it.dump().replace(' ', '\n')}


3

I think the answer should be yes to ecdsa but no to ed25519, but that it is currently no to both. You can externally generate an ecdsa keypair and load it into ssh/config/ca but vault-1.4.3 cannot sign using it. I haven't tried ed25519. Golang's ssh code (which vault uses) doesn't appear to know how to sign with ed25519 but should be able to sign with ecdsa. ...


3

If I am understanding your question correctly, what you are describing sounds like a perfect use case for SSM. You can store your RDS password as a secure string parameter encrypted by KMS, then reference it in you terraform file as a data source with decryption. With this method, you only have to reference your decrypted password, and never directly store ...


3

@kenorb example with hudson.util.Secret is good. Also answers listing all credentials are very useful (thanks @ymajoros for one-liner). These do not handle secret files though where secretBytes are used and still an encrypted string is shown. In such case the SecretBytes class needs to be used. Assuming the file is UTF-8, one can do: secret = "{....}" new ...


2

Google Container Registry is a potential option. Registry is private Image layers are stored on a Google Cloud Storage bucket, which is encrypted by Google (RSA) and can be additionally encrypted with a client key (RSA) Access control is granular down to each individual object stored on GCS bucket Client-side authentication is enforced via oauth2. Clients ...


2

Here is what I ended up using. Enjoy. for instance in $instances; do count=`aws ec2 describe-volumes --filters Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --query "Volumes[]" | jq -r '. | length';` name=`aws ec2 describe-tags --filters Name=resource-id,Values=$instance Name=key,Values=Name --query Tags[].Value |...


2

To get the number of non encrypted volumes you can run this command: aws ec2 describe-volumes --region <your_region> --filter "Name=encrypted,Values=false" --query "length(Volumes[])" length will return the length of the array Volumes flattened by the selection operator [] (more details on JMESPath documentation). As we filter the slection for non ...


2

For the record, The following snippet to be pasted into the console also does the job : def creds = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials( com.cloudbees.plugins.credentials.common.StandardUsernameCredentials.class, Jenkins.instance, null, null ) for(c in creds) { if(c instanceof com.cloudbees.jenkins....


2

I personally am a fan of Mozilla SOps, we've introduced it to two teams and it's gone down well both times, it has proven easy to implement both with local development and our CI/CD pipelines. It has support for PGP/GPG to encrypt secrets but also supports Amazon KMS, GCP KMS and Azure KeyVault thus works well in an enterprise cloud-native infrastructure.


2

This question ties in heavily with your other question with where the secrets are set and where they retrieved from. I assume your question is asking about 'canary deployments' where you change the config for only a small portion of your apps, to test things out before deploying everywhere. If you follow the best practice of using the 12 Factor app's ...


1

You'll want to be sure your spec.tls section has the following two items to tell the router you want both secure and insecure traffic allowed in the edge. apiVersion: route.openshift.io/v1 kind: Route metadata: name: my-app-ui namespace: my-namespace spec: host: my-host port: targetPort: http tls: insecureEdgeTerminationPolicy: Allow ...


1

If you want to create separate key pairs that are not dependent on your personal keys, the easiest way is to use a separate GPG home directory for each. For example, to create keys for "projectB", first create an empty directory, then tell gpg to use that dir as its home: mkdir projectB-gpg gpg --homedir ./projectB-gpg --gen-key That will do what you want, ...


1

Not sure if this is the right answer but let me give it a try with the limited knowledge i have on this. these are the resources that I found when I am looking up for tls enabling for my app service. please see if any of this works. msdn how to configure ciphersuite for app service enforce tls vrsion The client (browser) gives a list of cipher suites it can ...


1

Instead of storing them as variables in the bash script themselves, can you store them as environment variables on the system from which the bash script is executing? This is a pretty common practice that will allow your scripts to execute on different systems without having to modify the script on each and every one. Not sure what you mean by the AWS cli "...


1

The short answer: you would need to use a secret management system that provides 'audit logs'. There are many options for handling secrets out there, but unless the tool you use has audit logging, you'll never truly know for sure what credential was used where. I see you mentioned using Hashicorp's Vault. That's a really good one. They have audit logging ...


1

Azure's Confidential Computing leverages Intel® SGX to enable applications run code inside secure enclaves. Intel Software Gaurd Extensions (SGX) use a Memory Encryption Engine that encrypts any enclave data that leaves the CPU cache to the RAM using a key that is only accessible to the processor, preventing attacks such as cold-boot, tapping on the memory ...


1

I typically treat secrets as configuration data in scope. As such, it does not live alongside the code as they are handled by different release schedules and processes. A separate git repo, KMS, dynamo, s3, or inside your config management system (chef-vault/encrypted database in the chef world) are good places. Basically, you don't want to have to build ...


1

I'm not sure if you can do this without a loop. But you should be able to run the below in bash and get the right output: instances=`aws ec2 describe-instances --region us-east-1 --filters Name=instance-state-name,Values=running --query "Reservations[*].Instances[0].InstanceId" --output text` for instance in $instances; do aws ec2 describe-volumes --...


Only top voted, non community-wiki answers of a minimum length are eligible