3 ms·
I have used Jenkins, TeamCity, Bamboo, and GoCD. As with any tool, misconfiguration and lack of ops involvement is going to lead to clueless implementations. On
by solarengineer 10y ago
I have used Jenkins, TeamCity, Bamboo, and GoCD. As with any tool, misconfiguration and lack of ops involvement is going to lead to clueless implementations. One might as well say "I granted everyone admin access, and they are able to run any command now".
For all these tools, there is documentation on how to lock down access to the server, and also how to run the agents under various users accounts. On my current engagement, for e.g., I ensure that the various GoCD agents run as low privileged users, with access granted via sudo.
Further, running commands directly is easy. But a better pattern is to push these commands into a script, to check in the script into version control, and to then check out and run that script. At least GoCD is opinionated that way by enforcing that users use "materials" (which could be a checkout from a revision control system).
GoCD enforces something called a "sandbox", where the file references are restricted to only the working directory for that particular job. If one needs to access files outside of this sandbox, then one needs to explicitly invoke a shell - after which point the admin/script owner is responsible for what happens. This is because the GoCD admin/script owner permitted either a command interpreter to be invoked directly, or the script owner did so within their script.
I now-a-days deliver scripts as Ansible playbooks using GPG signed RPMs, the execute the Ansible playbooks in local mode.
The non-salted SHA1 passwords is a good report. GoCD lets uses specify either an htpasswd generated file, or an LDAP source. On enterprise implementations, I always link GoCD to an LDAPs source and manage the credentials there.
In short, if one doesn't read the documentation and just implements distributed orchestrators with zero ops sensibilities, then such WTFs of being able to execute any command would of course be possible.