2

我已将 Jenkins 设置为使用 Unix 用户/组数据库安全性,但除了运行 Jenkins 服务的用户之外,我无法使用我创建的任何用户登录。通过 ssh 或 su 在服务器上登录可以工作,但是当我尝试使用 Jenkins 界面时,它会给出“无效登录信息”消息。

根据我的阅读,我需要以 root 身份运行 jenkins,或者让启动 Jenkins 的用户访问我的影子文件。对我来说,这些都不是可行的选择。还有其他解决方法吗?

经过更多试验后,我发现让启动 Jenkins 的用户能够读取影子文件是不够的。我需要为影子文件的所有用户设置读取权限,以便能够使用其他帐户登录。此外,我尝试将 passwd 中的每个用户添加到影子组,但这也不起作用,所以我不确定 Jenkins 正在尝试访问影子文件,就像我尝试登录时一样。

詹金斯日志:

4-Dec-2012 11:05:28 AM hudson.security.AuthenticationProcessingFilter2 onUnsuccessfulAuthentication
INFO: Login attempt failed
org.acegisecurity.BadCredentialsException: pam_authenticate failed : Authentication failure; nested exception is org.jvnet.libpam.PAMException: pam_authenticate failed : Authentication failure
        at hudson.security.PAMSecurityRealm.authenticate(PAMSecurityRealm.java:78)
        at hudson.security.AbstractPasswordBasedSecurityRealm$Authenticator.retrieveUser(AbstractPasswordBasedSecurityRealm.java:137)
        at org.acegisecurity.providers.dao.AbstractUserDetailsAuthenticationProvider.authenticate(AbstractUserDetailsAuthenticationProvider.java:119)
        at org.acegisecurity.providers.ProviderManager.doAuthentication(ProviderManager.java:195)
        at org.acegisecurity.AbstractAuthenticationManager.authenticate(AbstractAuthenticationManager.java:45)
        at org.acegisecurity.ui.webapp.AuthenticationProcessingFilter.attemptAuthentication(AuthenticationProcessingFilter.java:71)
        at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:252)
        at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
        at org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter(BasicProcessingFilter.java:173)
        at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
        at jenkins.security.ApiTokenFilter.doFilter(ApiTokenFilter.java:63)
        at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
        at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249)
        at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:66)
        at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
        at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76)
        at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:164)
        at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
        at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
        at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:50)
        at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
        at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
        at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:81)
        at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
        at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
        at winstone.RequestDispatcher.forward(RequestDispatcher.java:331)
        at winstone.RequestHandlerThread.processRequest(RequestHandlerThread.java:215)
        at winstone.RequestHandlerThread.run(RequestHandlerThread.java:138)
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
        at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:334)
        at java.util.concurrent.FutureTask.run(FutureTask.java:166)
        at winstone.BoundedExecutorService$1.run(BoundedExecutorService.java:77)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603)
        at java.lang.Thread.run(Thread.java:636)
Caused by: org.jvnet.libpam.PAMException: pam_authenticate failed : Authentication failure
        at org.jvnet.libpam.PAM.check(PAM.java:106)
        at org.jvnet.libpam.PAM.authenticate(PAM.java:124)
        at hudson.security.PAMSecurityRealm.authenticate(PAMSecurityRealm.java:73)
        ... 34 more
4

1 回答 1

3

根据Hudson failed to use unix user/group to do authentication,你必须做两件事

  • 确保运行 jenkins 的用户对 /etc/shadow 具有读取权限
  • 在某些情况下,服务名称不能是随机的。特定于平台。

2个想法:

  • 使用“测试”按钮验证读取访问权限
  • 尝试根据您的平台将您的服务名称更改为“ssh”或“sshd”

您可能想用您的发现编辑https://wiki.jenkins-ci.org/display/JENKINS/PAM+Authentication+Plugin

于 2013-08-08T10:33:48.650 回答