Jenkins mail settings, plug-in email-ext, crack jenkins administrator secrets

Jenkins mail configuration

Manage Jenkins → configure system, find Jenkins Location to configure, here I use QQ mailbox

img

The email address must be the same as the administrator address, otherwise an error will be reported when sending emails. At the same time, the authorization code must be set in the QQ mailbox, and the authorization code must be filled in the place where the password is set above, otherwise the email will not be sent.

imgimg

Click Test configuration, if it shows "Email was successfully sent", it means that the mailbox is successfully configured

img

Go to QQ mailbox to check if you have received the email you just tested

img

Received, the mail configuration is successful. Click Save, enter the previous task, click Configure

Find the post-build operation, select E-mail Notification, and fill in the email address for receiving emails in Recipients

img img img

Check to keep the default, click save

Now let's test, deliberately make the build unsuccessful, and see if you can receive emails.

First, change the permissions of the target directory on jinkai02 so that it cannot be written:

[root@localhost tmp]# rm -rf jenkins_test/*

[root@localhost tmp]# cd /tmp/

[root@localhost tmp]# rm -rf jenkins_test/*

[root@localhost tmp]# chattr +i jenkins_test/

[root@localhost tmp]# ls jenkins_test/

Go back to the browser, click Build Now, and check the console output:

img

Go to QQ mailbox to check:

img

The mail is received and the mailbox configuration is successful.

But this is a bit bad. It will send email notifications only when the build fails. I want it to send email notifications regardless of whether the build succeeds or fails.

Use the plugin email-ext to configure mail

If you want it to send an email notification regardless of whether the build succeeds or fails, you must install a plug-in whose name is Email Extension Plugin. If you follow the steps above, then the plug-in is already installed. Manage Jenkins → Manage Plugins to check if this plugin is installed, install it if not.

img

Manage Jenkins → Configure System → Extended E-mail Notification, fill in SMTP server, check Use SMTP Authentication, then fill in User Name and Password, fill in the email authorization code for Password, and fill in 465 for SMTP port

img

Scroll down, locate Default Triggers, and select always, which means that email notifications will be sent no matter what the situation is. Then clear the email notification set before, apply and save

img img

Open the previously created linuxprobe task → configuration, remove the post-build operation, click to add post-build operation steps, select Editable Email Notification, add your own mailbox in the Project Recipient List, and then continue to drop down and click Advanced Setting, locate Triggers, you can click Add the conditions for sending emails at Add Trigger

img img img img

Now let’s test to see if we can receive emails.

First change back to the original permissions of the target directory on jinkai02:

[root@localhost tmp]# chattr -i jenkins_test/

Go back to the browser, click Build Now, and check the console output:

img

Go to QQ mailbox to check:

img

The mail is received and the mailbox configuration is successful.

Crack the administrator password

General initial password

Under normal circumstances, in the Jenkins environment after the initialization is completed, the initial password can be seen directly by cat under /var/lib/jenkins/secrets/initialAdminPassword, and then log in according to the prompt.

Password after normal operation

If the environment that has been running normally after logging in, this file no longer exists. At this time, the password has a file beginning with albert (this is the user name I set up) under /var/lib/jenkins/users. The default may be Yes

/var/lib/jenkins/users/albert_3614558779671548111/config.xml

cat can view

<passwordHash>#jbcrypt:$2a$10$txFrUEMY4x9YmCtIYEze3O.xr.dZXnDBzyeRU329Gm.rvu6zCTpfm</passwordHash> A
hash-encrypted password string, but it looks like only a look at it. How to crack the password? The following
password environment configuration is in /var/lib/jenkins/config.xml

Back up the /var/lib/jenkins/config.xml file to restore the configuration later

[root@jinkai01 jenkins]# cp config.xml config.xml.bak

Modify the password environment configuration under the config.xml file

vim /var/lib/jenkins/config.xml

#Delete the following code snippets, yes, it is a deletion, not a comment, the comment is useless, the comment will be automatically restored later, and the modification effect will not be achieved

<useSecurity>true</useSecurity>

<authorizationStrategy class="hudson.security.FullControlOnceLoggedInAuthorizationStrategy">

<denyAnonymousReadAccess>true</denyAnonymousReadAccess>

</authorizationStrategy>

<securityRealm class="hudson.security.HudsonPrivateSecurityRealm">

<disableSignup>true</disableSignup>

<enableCaptcha>false</enableCaptcha>

</securityRealm>

Restart the service after modification

[root@jinkai01 jenkins]# systemctl restart jenkins

When I log in to the Jenkins page again, I find that I don’t need to log in anymore, I can directly enter the page, and I have administrator rights

Manage Jenkins ----Configure Global Security (Configure Global Security)

img

Security domain selection--Jenkins' own user database---Save

img

User list--select user---set---password (set new password)--save

imgimgimg

Restore the config.xml file and restart the service

[root@jinkai01 jenkins]# cp config.xml.bak config.xml

cp: Do you want to overwrite "config.xml"? yes

[root@jinkai01 jenkins]# systemctl restart jenkins

Log in to jenkins on the web page again, find the login interface for entering the user and password, try to log in with a new password

imgimg

login successful

Guess you like

Origin blog.51cto.com/11451960/2640809