8

I have a bare-bones install of jenkins on my Ubuntu server that I installed using just sudo apt-get install jenkins, as a result, jenkins is now accessible from all the domains that point to my box by simply adding :8080 on the the URL.

I have successfully configured apache to proxy jenkins to I can access it from ci.mydomain.com, but I cannot work out how to prevent jenkins from being accessible on port 8080.

Here is my apache conf:

<VirtualHost xx.xx.xx.xx:80>
    ServerAdmin [email protected]
    ServerName ci.mydomain.com

    ProxyPass         /  http://localhost:8080/
    ProxyPassReverse  /  http://localhost:8080/
    ProxyRequests     Off

    <Proxy http://localhost:8080/*>
        Order deny,allow
        Allow from all
    </Proxy>
</VirtualHost>

I've followed the Ubuntu instructions here, but they didn't seem to have any effect.

2
  • You can use iptables since it's Ubuntu, to block all non-local access to port 8080. iptables -A INPUT -t tcp --dport 8080 -s localhost -j ACCEPT and iptables -A INPUT -t tcp --dport 8080 -j DROP
    – ionFish
    Jun 28, 2012 at 21:36
  • @ionFish Thanks, it complains about the --dport option being unrecognised though, add this as an answer maybe?
    – Dunhamzzz
    Jun 28, 2012 at 21:46

3 Answers 3

10

You can use iptables since it's Ubuntu, to block all non-local access to port 8080.

iptables -A INPUT -p tcp --dport 8080 -s localhost -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
3
  • The response I get is iptables v1.4.12: unknown option "--dport"
    – Dunhamzzz
    Jun 28, 2012 at 21:59
  • I'll look into that in a bit, I've got important stuff to do at this second.
    – ionFish
    Jun 28, 2012 at 22:00
  • it was -p instead of -t that was causing the dport issue, I have updated your answer
    – Dunhamzzz
    Jun 28, 2012 at 22:07
1

There is another solution (without the need for IPtables):

  • Prevent jenkins from being accessed outside of the server in port 8080:

    • Edit file /etc/default/jenkins
    • Add HTTP_HOST=127.0.0.1
    • In the end change the line:

      • From: JENKINS_ARGS="--webroot=/var/cache/$NAME/war --httpPort=$HTTP_PORT"
      • To: JENKINS_ARGS="--webroot=/var/cache/$NAME/war --httpPort=$HTTP_PORT --httpListenAddress=$HTTP_HOST"
    • Restart the jenkins systemctl restart jenkins

0
0

This seems to not work.


There is another solution, however, without the need for IPtables:

Prevent jenkins from being accessed outside of the server in port 8080:

  • Edit file /etc/default/jenkins

  • Add HTTP_HOST=127.0.0.1

  • In the end change the line:

    From:

    JENKINS_ARGS="--webroot=/var/cache/$NAME/war --httpPort=$HTTP_PORT"
    

    To:

    JENKINS_ARGS="--webroot=/var/cache/$NAME/war --httpPort=$HTTP_PORT --httpListenAddress=$HTTP_HOST"
    
  • Restart the jenkins systemctl restart jenkins

1
  • I got the reason why /etc/default/jenkins does not work anymore, since from version 2.332.1, which relies on systemd rather than the init system. but when I upgrade to 2.332.3, it seem works again. May 7, 2022 at 2:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.