4 ms·

How do you let jenkins install packages and make changes to the machine? Passwordless sudo?

• mpdehaan2 13y ago
  That's one way, you could also allow SSH key access as root too. Ansible also has a --ask-pass and --ask-sudo-pass if you want to provide a password.
  • herge 13y ago
    So you store a password that will give you root/sudo on your production machine in your deployment code, or just on your ci server?
    • mpdehaan2 13y ago
      I would suggest just using keys in this case.
• smoyer 13y ago
  I turn off password access to production machines, so nobody accesses them without a known key anyway. Ansible has its own key installed on the servers and its account is allowed to sudo without a password.
  • herge 13y ago
    So if I can break into your ci machine (or just get jenkins to run random commands on your prod server, which is probably easier), I then have sudo access to your prod server? Using ansible from a local machine is fine, because you can make your devs type in passwords and etc, but I can't think of a secure way to do it with continuous integration.
    • jessaustin 13y ago
      Don't assume that breaking into his CI instance is easier than breaking into the prod server. It's probably on a private subnet, in the first place.