是否有一种方法来重置所有(或只是禁用安全设置)从命令行没有用户/密码,因为我已经设法完全锁定自己的詹金斯?


当前回答

关于修改的答案是正确的。然而,我认为应该提到的是,如果你激活了“基于项目的矩阵授权策略”,/var/lib/jenkins/config.xml看起来就像这样。删除/var/lib/jenkins/config.xml并重新启动jenkins也可以做到这一点。我还删除了/var/lib/jenkins/users中的用户,从头开始。

<authorizationStrategy class="hudson.security.ProjectMatrixAuthorizationStrategy">
    <permission>hudson.model.Computer.Configure:jenkins-admin</permission>
    <permission>hudson.model.Computer.Connect:jenkins-admin</permission>
    <permission>hudson.model.Computer.Create:jenkins-admin</permission>
    <permission>hudson.model.Computer.Delete:jenkins-admin</permission>
    <permission>hudson.model.Computer.Disconnect:jenkins-admin</permission>
    <!-- if this is missing for your user and it is the only one, bad luck -->
    <permission>hudson.model.Hudson.Administer:jenkins-admin</permission>
    <permission>hudson.model.Hudson.Read:jenkins-admin</permission>
    <permission>hudson.model.Hudson.RunScripts:jenkins-admin</permission>
    <permission>hudson.model.Item.Build:jenkins-admin</permission>
    <permission>hudson.model.Item.Cancel:jenkins-admin</permission>
    <permission>hudson.model.Item.Configure:jenkins-admin</permission>
    <permission>hudson.model.Item.Create:jenkins-admin</permission>
    <permission>hudson.model.Item.Delete:jenkins-admin</permission>
    <permission>hudson.model.Item.Discover:jenkins-admin</permission>
    <permission>hudson.model.Item.Read:jenkins-admin</permission>
    <permission>hudson.model.Item.Workspace:jenkins-admin</permission>
    <permission>hudson.model.View.Configure:jenkins-admin</permission>
    <permission>hudson.model.View.Create:jenkins-admin</permission>
    <permission>hudson.model.View.Delete:jenkins-admin</permission>
    <permission>hudson.model.View.Read:jenkins-admin</permission>
  </authorizationStrategy>

其他回答

我发现有问题的文件位于/var/lib/jenkins中,名为config.xml,修改后解决了这个问题。

\.jenkins\secrets\initialAdminPassword

从initialAdminPassword文件复制密码,并将其粘贴到Jenkins中。

关于修改的答案是正确的。然而,我认为应该提到的是,如果你激活了“基于项目的矩阵授权策略”,/var/lib/jenkins/config.xml看起来就像这样。删除/var/lib/jenkins/config.xml并重新启动jenkins也可以做到这一点。我还删除了/var/lib/jenkins/users中的用户,从头开始。

<authorizationStrategy class="hudson.security.ProjectMatrixAuthorizationStrategy">
    <permission>hudson.model.Computer.Configure:jenkins-admin</permission>
    <permission>hudson.model.Computer.Connect:jenkins-admin</permission>
    <permission>hudson.model.Computer.Create:jenkins-admin</permission>
    <permission>hudson.model.Computer.Delete:jenkins-admin</permission>
    <permission>hudson.model.Computer.Disconnect:jenkins-admin</permission>
    <!-- if this is missing for your user and it is the only one, bad luck -->
    <permission>hudson.model.Hudson.Administer:jenkins-admin</permission>
    <permission>hudson.model.Hudson.Read:jenkins-admin</permission>
    <permission>hudson.model.Hudson.RunScripts:jenkins-admin</permission>
    <permission>hudson.model.Item.Build:jenkins-admin</permission>
    <permission>hudson.model.Item.Cancel:jenkins-admin</permission>
    <permission>hudson.model.Item.Configure:jenkins-admin</permission>
    <permission>hudson.model.Item.Create:jenkins-admin</permission>
    <permission>hudson.model.Item.Delete:jenkins-admin</permission>
    <permission>hudson.model.Item.Discover:jenkins-admin</permission>
    <permission>hudson.model.Item.Read:jenkins-admin</permission>
    <permission>hudson.model.Item.Workspace:jenkins-admin</permission>
    <permission>hudson.model.View.Configure:jenkins-admin</permission>
    <permission>hudson.model.View.Create:jenkins-admin</permission>
    <permission>hudson.model.View.Delete:jenkins-admin</permission>
    <permission>hudson.model.View.Read:jenkins-admin</permission>
  </authorizationStrategy>

我们可以在打开安全系统的情况下重置密码。

/var/lib/Jenkins/users/admin/中的config.xml文件在某种程度上类似于Linux或类unix系统中的/etc/shadow文件或Windows中的SAM文件,因为它存储了帐户密码的散列。

如果您需要在不登录的情况下重置密码,您可以编辑这个文件并用bcrypt生成的新哈希替换旧的哈希:

$ pip install bcrypt
$ python
>>> import bcrypt
>>> bcrypt.hashpw("yourpassword", bcrypt.gensalt(rounds=10, prefix=b"2a"))
'YOUR_HASH'

这将输出您的哈希,带有前缀2a,这是Jenkins哈希的正确前缀。

现在,编辑config.xml文件:

...
<passwordHash>#jbcrypt:REPLACE_THIS</passwordHash>
...

一旦你插入了新的散列,重置Jenkins:

(如果你在systemd系统上):

sudo systemctl restart Jenkins

现在您可以登录了,而且您的系统一秒钟都没有打开。

我会在解决方案的基础上增加一些改进:

https://stackoverflow.com/a/51255443/5322871

在我的场景中,它部署了带有nfs卷的Swarm集群,为了执行密码重置,我做了以下工作:

附着在豆荚上:

$ docker exec -it <pod-name> bash

使用python生成哈希密码(不要忘记在你的引用密码之外指定字母b,方法hashpw需要一个以字节为单位的参数):

$ pip install bcrypt
$ python
>>> import bcrypt
>>> bcrypt.hashpw(b"yourpassword", bcrypt.gensalt(rounds=10, prefix=b"2a"))
'YOUR_HASH'

一旦进入容器,找到所有config.xml文件:

$ find /var/ -type f -iname "config.xml"

一旦确定,修改字段的值(在我的情况下,config.xml在另一个位置):

$ vim /var/jenkins_home/users/admin_9482805162890262115/config.xml
...
<passwordHash>#jbcrypt:YOUR_HASH</passwordHash>
...

重新启动服务:

docker service scale <service-name>=0
docker service scale <service-name>=1

希望这对任何人都有帮助。