121
votes
Accepted
How to decrypt Jenkins passwords from credentials.xml?
Luckily there is a hudson.util.Secret.decrypt() function which can be used for this, so:
In Jenkins, go to: /script page.
Run the following command:
println(hudson.util.Secret.decrypt("{XXX=}"))
or:...
- 7,791
36
votes
How to decrypt Jenkins passwords from credentials.xml?
Here is a short snippet you can just run from the jenkins script console, to dump all of your credentials to plain text.
com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance()....
- 461
10
votes
How to decrypt Jenkins passwords from credentials.xml?
Based on Magnus' answer but as a simple one-liner with still readable output:
com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().forEach{println it.dump()....
9
votes
Accepted
Git Files Encryption for Business
There really is no way to take on your problem with git, which is to deny a developer with access to the code (required to work with it) the possibility to steal the code. This is because as soon as ...
- 4,866
7
votes
Accepted
How to storing encrypted secrets in code for a serverless.com project?
There are a couple of elements to consider here:
It is valuable to have the capability to maintain configuration with a separate release cadence from the code that is being configured. Doing so ...
- 11.6k
6
votes
Accepted
Is Azure's confidential computing essentially encrypted RAM?
The article you are referencing mentions encrypted RAM but that was only a reference to possibilities of enhancing the technology more in the future, not about the current state of confidential ...
- 525
5
votes
Accepted
When your micro service in production needs a secret, where is the secret stored and retrieved from?
Short answer
Ideally, you should store secrets as environment variables, and retrieve them from a secrets management system like Hashicorp's Vault or AWS Parameter store.
Long answer
I saw your ...
- 1,432
5
votes
How to decrypt Jenkins passwords from credentials.xml?
@kenorb example with hudson.util.Secret is good. Also answers listing all credentials are very useful (thanks @ymajoros for one-liner).
These do not handle secret files though where secretBytes are ...
- 153
4
votes
How to decrypt Jenkins passwords from credentials.xml?
For the record, The following snippet to be pasted into the console also does the job :
def creds = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
com.cloudbees.plugins....
- 171
3
votes
Accepted
Vault `SSH-CA` Elliptic Curve rather than `RSA`
I think the answer should be yes to ecdsa but no to ed25519, but that it is currently no to both.
You can externally generate an ecdsa keypair and load it into ssh/config/ca but vault-1.4.3 cannot ...
- 46
3
votes
Accepted
How do I use only an encrypted version of my AWS RDS password in my terraform code?
If I am understanding your question correctly, what you are describing sounds like a perfect use case for SSM. You can store your RDS password as a secure string parameter encrypted by KMS, then ...
- 3,218
2
votes
Encrypting docker images (end to end); transporting over offline channels
Google Container Registry is a potential option.
Registry is private
Image layers are stored on a Google Cloud Storage bucket, which is encrypted by Google (RSA) and can be additionally encrypted ...
- 121
2
votes
Accepted
How can I get a list of encrypted disks for instances that are running on the AWS CLI?
Here is what I ended up using. Enjoy.
for instance in $instances;
do
count=`aws ec2 describe-volumes --filters Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --...
- 1,133
2
votes
Accepted
What is the simplest way to list which attached disks are encrypted (and which not) on AWS?
To get the number of non encrypted volumes you can run this command:
aws ec2 describe-volumes --region <your_region> --filter "Name=encrypted,Values=false" --query "length(Volumes[])"
length ...
- 11.3k
2
votes
Accepted
What options are available to encrypt the content of git repositories?
I personally am a fan of Mozilla SOps, we've introduced it to two teams and it's gone down well both times, it has proven easy to implement both with local development and our CI/CD pipelines.
It has ...
- 11.6k
2
votes
How do you change a secret that half of your production applications use right now?
This question ties in heavily with your other question with where the secrets are set and where they retrieved from.
I assume your question is asking about 'canary deployments' where you change the ...
- 1,432
1
vote
Use an asymmetric cypher to secure Ansible vault
Another solution, which would allow you to accomplish the same goals, would be to encrypt your facts files with Mozilla SOPS.
SOPS does a good job of just encrypting parts of the files that you want ...
- 1,376
1
vote
Use an asymmetric cypher to secure Ansible vault
Is it possible to setup Ansible vault to use asymmetric encryption?
To setup or configure unfortunately not. It might be possible to enhance the functionality of vault.py and implement such.
...
- 358
1
vote
How to ensure data protection on remote server?
First of all, all data you can compile can be decompiled if you really want its a question about time, so you are correct here.
I did not know where in the world you are, but I will recommend AWS, ...
1
vote
What are the real world benefits of RDS instance (at rest) encryption?
This is a defense in depth tactic.
There are other defense mechanisms in place at AWS to prevent data leakage such as disk destruction on disposal or limiting access to data centers to approved ...
- 664
1
vote
How do I setup an OpenShift route that will allow both 80 and 443 traffic to my app?
You'll want to be sure your spec.tls section has the following two items to tell the router you want both secure and insecure traffic allowed in the edge.
apiVersion: route.openshift.io/v1
kind: ...
- 353
1
vote
How to create unique GPG Keys for different environments / projects
If you want to create separate key pairs that are not dependent on your personal keys, the easiest way is to use a separate GPG home directory for each. For example, to create keys for "projectB", ...
- 96
1
vote
How to check accepted cipher suites by an Azure App Service?
Not sure if this is the right answer but let me give it a try with the limited knowledge i have on this.
these are the resources that I found when I am looking up for tls enabling for my app service. ...
1
vote
Accepted
Securely saving AZURE_STORAGE_KEY and storage account name in Linux systems
Instead of storing them as variables in the bash script themselves, can you store them as environment variables on the system from which the bash script is executing? This is a pretty common practice ...
- 3,218
1
vote
How do you know which secrets and credentials of your production services were used, and by whom/what?
The short answer: you would need to use a secret management system that provides 'audit logs'.
There are many options for handling secrets out there, but unless the tool you use has audit logging, ...
- 1,432
1
vote
Is Azure's confidential computing essentially encrypted RAM?
Azure's Confidential Computing leverages Intel® SGX to enable applications run code inside secure enclaves. Intel Software Gaurd Extensions (SGX) use a Memory Encryption Engine that encrypts any ...
- 11
1
vote
How to storing encrypted secrets in code for a serverless.com project?
I typically treat secrets as configuration data in scope. As such, it does not live alongside the code as they are handled by different release schedules and processes. A separate git repo, KMS, ...
- 109
1
vote
How can I get a list of encrypted disks for instances that are running on the AWS CLI?
I'm not sure if you can do this without a loop. But you should be able to run the below in bash and get the right output:
instances=`aws ec2 describe-instances --region us-east-1 --filters Name=...
- 11
Only top scored, non community-wiki answers of a minimum length are eligible