Hacker News new | ask | show | jobs
by zimbatm 3270 days ago
Google is moving away from network-centric security and VPNs. See https://cloud.google.com/beyondcorp/ . The threat model is a bit different but you could also follow their approach and put an auth proxy in front of Jenkins and deploy it on the public Internet.

But yeah, don't expose Jenkins to the Internet directly. Last month I saw a Jenkins instance that was mining bitcoins. The worm had used one of Java's serialisation vuln to get in the box and install the miner.
1 comments
tomjen3 3270 days ago
No vpn means any vulnerability can be attacked over the internet.
link
zimbatm 3270 days ago
Not at all, it means the proxy can be attacked over the Internet. Just like the VPN can be attacked over the Internet. Once you're past that it's the same story.
link
tomjen3 3270 days ago
At minimum that means your SSH service is also vulnerable, no?
link