login security

19 views

Skip to first unread message

Ewelina Wilkosz

unread,

May 6, 2021, 3:04:38 AM5/6/21

to Jenkins Users

I was asked to look into possible ways of adressing some security concerns and I was wondering if anyone here can help with pointing good sources to read about it.

Here are the issues:

1. account lockout - is it possible to lock the account after a certain number of unsuccessful login attempts (Active Directory in use)?

2. session identifier - is it possible to change session identifier values after login (to prevent a risk of the user being impersonated)?

Thank in advance for your help!

Dirk Heinrichs

unread,

May 6, 2021, 3:27:20 AM5/6/21

to jenkins...@googlegroups.com

Am Donnerstag, den 06.05.2021, 00:04 -0700 schrieb Ewelina Wilkosz:

1. account lockout - is it possible to lock the account after a certain number of unsuccessful login attempts (Active Directory in use)?

This is an AD feature, so yes (you might need to disable AD caching in Jenkins, but I'm not sure). Our AD is configured to lock accounts for 15 minutes after 3 failed login attempts. Doesn't matter where these failed attempts came from (Jenkins, Windows login, ...).

HTH...

Dirk

--

Dirk Heinrichs

Senior Systems Engineer, Delivery Pipeline

OpenText ™ Discovery | Recommind

Phone: +49 2226 15966 18

Email: dhei...@opentext.com

Website: www.recommind.de

Recommind GmbH, Von-Liebig-Straße 1, 53359 Rheinbach

Vertretungsberechtigte Geschäftsführer Gordon Davies, Madhu Ranganathan, Christian Waida, Registergericht Amtsgericht Bonn, Registernummer HRB 10646

This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden

Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail sind nicht gestattet.