Security and Best Practices

Access Control

• Use Matrix-based security or a plugin (Role-based Strategy) with least privilege: separate admin, developer and read-only roles.
• Force HTTPS behind a reverse proxy (nginx/Tomcat with TLS).
• Never run builds as root; agents should use non-privileged system accounts.

Secrets

• Store all secrets in Credentials and inject with withCredentials.
• Redact secret values from the console log (the Credentials plugin does this automatically).
• Rotate tokens regularly and revoke leaked ones immediately.

Keep It Current

# automated upgrade checks will tell you when a fix is out
sudo apt update && sudo apt upgrade -y jenkins

• Upgrade Jenkins and plugins regularly; check security advisories.
• Disable the built-in script console for non-admins in production.

Backup and Disaster Recovery

Back up $JENKINS_HOME - especially jobs/, config.xml, credentials/ and secrets/. Back up with encrypted credentials; test restoring to a fresh server.

Operational Hygiene

• Keep Jenkinsfiles short and reviewed; treat them like production code.
• Clean old builds/workspaces regularly to save disk.
• Monitor disk, memory and queue length - most "Jenkins is slow" problems are capacity problems.

Key Points

• Least privilege + HTTPS + updated plugins is the baseline.
• Secrets belong in Credentials, never in code.
• Backups without a tested restore are just copies of data.