Agent and Controller Security

Establish rigid boundary protections by hardening agent connections, enforcing inbound control parameters, and isolating the orchestration plane from untrusted pipeline runtimes.

What is Agent and Controller Security?

In a distributed Jenkins architecture, the controller coordinates the entire system, while agents execute the code. If an agent node is compromised via a malicious or insecure script, the attacker could try to break out of the workspace sandbox and execute unauthorized commands directly on the controller filesystem.

Agent and Controller Security establishes strict boundaries using protocols like inbound agent network filtering, SSH transport validation, and the standard Agent-to-Controller Access Control system. Hardening this boundary prevents agents from requesting restricted configuration data, credentials, or global keys stored within the controller's core memory space.

Key Isolation Concepts

Practical Node Isolation Blueprint

Below is a declarative pipeline that forces the execution engine to drop down to a low-privilege container node with strict resource constraints and workspace isolation rules:

pipeline {
    agent {
        node {
            label 'isolated-linux-agent'
            customWorkspace '/var/jenkins/isolated-runs/build-' + UUID.randomUUID().toString()
        }
    }
    options {
        // Stop execution if an agent becomes unresponsive or hangs intentionally
        timeout(time: 30, unit: 'MINUTES')
    }
    stages {
        stage('Validate System Boundary') {
            steps {
                echo 'Checking local node profile and preventing host execution escalation...'
                // Ensure the executing context is running as a restricted build user
                sh 'whoami'
                sh 'pwd'
            }
        }
        stage('Workspace Cleanup') {
            steps {
                echo 'Wiping isolated ephemeral directories...'
            }
        }
    }
    post {
        always {
            // Delete the unique workspace instantly to prevent persistence vectors
            deleteDir()
        }
    }
}

Security Hardening Exercise

1. Verify Inbound Port Status: Navigate to Manage Jenkins → Security, scroll down to Agents, and check if the inbound TCP port is disabled, set to random, or configured via a static structural port.
2. Audit Agent File Paths: Inspect the structural settings of a specific node under Manage Jenkins → Nodes and locate the Remote root directory parameter to trace where build code is placed.
3. Examine Access Control Logs: View your system logs for `jenkins.security.ChannelConfigurator` or look for rejected command anomalies to verify that agent-to-controller access filters are working correctly.
4. Implement Workspace Deletion: Update an existing pipeline to leverage the `deleteDir()` or `cleanWs()` methods within a `post { always { ... } }` execution block to prevent leftover artifacts from persisting on the agent.