First version of password hashing for jenkins.
diff --git a/README.rst b/README.rst
index a83d61f..1d20ec7 100644
--- a/README.rst
+++ b/README.rst
@@ -306,6 +306,65 @@
- repository: base
file: macros/git.groovy
+SMTP server settings
+
+.. code-block:: yaml
+
+ jenkins:
+ master:
+ email:
+ engine: "smtp"
+ host: "smtp.domain.com"
+ user: "user@domain.cz"
+ password: "smtp-password"
+ port: 25
+
+Jenkins script approvals
+
+.. code-block:: yaml
+
+ jenkins:
+ master:
+ approved_scripts:
+ - method groovy.json.JsonSlurperClassic parseText java.lang.String
+
+Credentials enforcing
+
+.. code-block:: yaml
+
+ jenkins:
+ master:
+ credentials:
+ - type: username_password
+ scope: GLOBAL
+ id: credential-1
+ desc: ""
+ username: admin
+ password: "password"
+ - type: ssh_key
+ scope: GLOBAL
+ id: key-credential
+ desc: ""
+ username: admin
+ password: "key-password"
+ key: |
+ xxxxxxxxxxxxxxxxxxxx
+
+Users enforcing
+
+.. code-block:: yaml
+
+ jenkins:
+ user:
+ admin:
+ api_token: xxxxxxxxxx
+ password: admin_password
+ email: admin@domain.com
+ user01:
+ api_token: xxxxxxxxxx
+ password: user_password
+ email: user01@domain.com
+
Usage
=====
diff --git a/_modules/jenkins_hash.py b/_modules/jenkins_hash.py
new file mode 100644
index 0000000..6796bbd
--- /dev/null
+++ b/_modules/jenkins_hash.py
@@ -0,0 +1,9 @@
+import hashlib
+import random
+import string
+
+def encode_password(password):
+ salt = ''.join(random.SystemRandom().choice(string.ascii_letters)
+ for i in range(6))
+ hash_ = hashlib.sha256("%s{%s}" % (password, salt)).hexdigest()
+ return "%s:%s" % (salt, hash_)
\ No newline at end of file
diff --git a/jenkins/files/config.xml.user b/jenkins/files/config.xml.user
index 9d442a4..aca8b2b 100644
--- a/jenkins/files/config.xml.user
+++ b/jenkins/files/config.xml.user
@@ -27,7 +27,7 @@
<insensitiveSearch>false</insensitiveSearch>
</hudson.search.UserSearchProperty>
<hudson.security.HudsonPrivateSecurityRealm_-Details>
- <passwordHash>{{ user.password_hash }}</passwordHash>
+ <passwordHash>{{ salt['jenkins_hash.encode_password'](user.password) }}</passwordHash>
</hudson.security.HudsonPrivateSecurityRealm_-Details>
{%- if user.public_keys is defined %}
<org.jenkinsci.main.modules.cli.auth.ssh.UserPropertyImpl>
diff --git a/jenkins/files/credentials.xml b/jenkins/files/credentials.xml
index 8e3da7b..fc6c244 100644
--- a/jenkins/files/credentials.xml
+++ b/jenkins/files/credentials.xml
@@ -14,7 +14,7 @@
<id>{{ credential.id }}</id>
<description>{{ credential.desc }}</description>
<username>{{ credential.username }}</username>
- <password>{{ credential.password_hash }}</password>
+ <password>{{ salt['jenkins_hash.encode_password'](credential.password) }}</password>
</com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl>
{%- elif credential.type == "ssh_key" %}
<com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey plugin="ssh-credentials@1.12">
@@ -22,7 +22,9 @@
<id>{{ credential.id }}</id>
<description>{{ credential.desc }}</description>
<username>{{ credential.username }}</username>
- <passphrase>{{ credential.password_hash }}</passphrase>
+ {%- if credential.password is defined %}
+ <passphrase>{{ salt['jenkins_hash.encode_password'](credential.password) }}</passphrase>
+ {%- endif %}
<privateKeySource class="com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey$DirectEntryPrivateKeySource">
<privateKey>{{ credential.key }}</privateKey>
</privateKeySource>
diff --git a/jenkins/files/hudson.tasks.Mailer.xml b/jenkins/files/hudson.tasks.Mailer.xml
index ab60d4d..00c146d 100644
--- a/jenkins/files/hudson.tasks.Mailer.xml
+++ b/jenkins/files/hudson.tasks.Mailer.xml
@@ -3,7 +3,7 @@
<?xml version='1.0' encoding='UTF-8'?>
<hudson.tasks.Mailer_-DescriptorImpl plugin="mailer@1.18">
<smtpAuthUsername>{{ master.email.user }}</smtpAuthUsername>
- <smtpAuthPassword>{{ master.email.password_hash }}</smtpAuthPassword>
+ <smtpAuthPassword>{{ salt['jenkins_hash.encode_password'](master.email.password) }}</smtpAuthPassword>
<smtpHost>{{ master.email.host }}</smtpHost>
<useSsl>false</useSsl>
<smtpPort>{{ master.email.port }}</smtpPort>
diff --git a/metadata/service/master/single.yml b/metadata/service/master/single.yml
index 0d27f12..238fe90 100644
--- a/metadata/service/master/single.yml
+++ b/metadata/service/master/single.yml
@@ -29,7 +29,6 @@
admin:
api_token: ${_param:jenkins_admin_token}
password: ${_param:jenkins_admin_password}
- password_hash: ${_param:jenkins_admin_password_hash}
email: root@domain.com
job_builder:
enabled: true