Creating a new Jenkins Server

First step, make sure java -version reports 1.6 or higher. If the command fails or the version isn't high enough, download the latest version of Java JDK from Oracle (http://www.oracle.com/technetwork/java/javase/downloads/index.html) (jdk-7u25-linux-x64.tar.gz at the time of writing) - a quick uname -m will let you know if you need the 32 or 64bit version. Installation instructions are available here (http://docs.oracle.com/javase/7/docs/webnotes/install/linux/linux-jdk.html#install-64).

My preference is to extract these to /usr/local and then ln -s /usr/local/jdk1.7.0_25 /usr/local/jdk.

Add /usr/local/jdk/bin to your $PATH.

Download the latest Jenkins WAR (1.519 currently) file from http://mirrors.jenkins-ci.org/war/latest/.

Create the jenkins home directory:

mkdir /var/jenkins
ln -s /var/jenkins /home/jenkins
chown jenkins:linux_developers /var/jenkins
chown jenkins:linux_developers jenkins.war
mv jenkins.war /var/jenkins

Jenkins init script:

#!/bin/bash
 
### BEGIN INIT INFO
# Provides:          jenkins
# Required-Start:    $remote_fs $network
# Required-Stop:     $remote_fs $network
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: starts jenkins
# Description:       An extendable open source continuous integration server
# ### END INIT INFO
 
PID=`ps -ef | grep jenkins.war | grep -v grep | awk '{print $2}'`
 
case $1 in "start")
        echo -n "Starting Jenkins... "
        su jenkins -c 'nohup /usr/local/jdk/bin/java -jar /var/jenkins/jenkins.war --httpPort=8080 > /var/jenkins/jenkins.log 2>/dev/null &'
        echo "Done."
        ;;
 
        "stop")
        echo -n "Stopping Jenkins... "
        [ ! -z "$PID" ] && kill $PID || echo "Could not find process ID!"
        ;;
 
        "restart")
        $0 stop
        $0 start
        ;;
 
        "status")
        ps -ef | grep jenkins.war | grep -v grep || echo "Jenkins is not running."
        ;;
 
        *)
        echo "Usage: service jenkins <start|stop|status|restart>"
esac

iptables:

*nat
:PREROUTING ACCEPT [4:463]
:POSTROUTING ACCEPT [18:1242]
:OUTPUT ACCEPT [18:1242]
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
COMMIT
 
# usage: iptables-restore < firewall.rules
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [606:306949]
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
 
 
 
 
# Reject packets from RFC1918 class networks (i.e., spoofed)
-A INPUT -s 10.0.0.0/8     -j DROP
-A INPUT -s 169.254.0.0/16 -j DROP
-A INPUT -s 172.16.0.0/12  -j DROP
-A INPUT -s 127.0.0.0/8    -j DROP
 
-A INPUT -s 224.0.0.0/4      -j DROP
-A INPUT -d 224.0.0.0/4      -j DROP
-A INPUT -s 240.0.0.0/5      -j DROP
-A INPUT -d 240.0.0.0/5      -j DROP
-A INPUT -s 0.0.0.0/8        -j DROP
-A INPUT -d 0.0.0.0/8        -j DROP
-A INPUT -d 239.255.255.0/24 -j DROP
-A INPUT -d 255.255.255.255  -j DROP
 
 
 
 
# Allow most ICMP packets to be received (so people can check our
# presence), but restrict the flow to avoid ping flood attacks
-A INPUT -p icmp -m icmp --icmp-type address-mask-request -j DROP
-A INPUT -p icmp -m icmp --icmp-type timestamp-request -j DROP
-A INPUT -p icmp -m icmp -m limit --limit 1/second -j ACCEPT
 
 
 
 
# Drop invalid packets immediately
-A INPUT   -m state --state INVALID -j DROP
-A FORWARD -m state --state INVALID -j DROP
-A OUTPUT  -m state --state INVALID -j DROP
 
 
 
 
 
# Drop bogus TCP packets
-A INPUT -p tcp -m tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
-A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
 
 
 
 
# Drop excessive RST packets to avoid SMURF attacks, by given the
# next real data packet in the sequence a better chance to arrive first.
-A INPUT -p tcp -m tcp --tcp-flags RST RST -m limit --limit 2/second --limit-burst 2 -j ACCEPT
 
 
 
 
# Protect against SYN floods by rate limiting the number of new
# connections from any host to 60 per second.  This does *not* do rate
# limiting overall, because then someone could easily shut us down by
# saturating the limit.
#-A INPUT -m state --state NEW -p tcp -m tcp --syn -m recent --name synflood --set
#-A INPUT -m state --state NEW -p tcp -m tcp --syn -m recent --name synflood --update --seconds 1 --hitcount 60 -j DROP
# The above doesn't seem to work?
 
 
 
# Anyone who tried to portscan us is locked out for an entire day.
-A INPUT   -m recent --name portscan --rcheck --seconds 86400 -j DROP
-A FORWARD -m recent --name portscan --rcheck --seconds 86400 -j DROP
 
# Once the day has passed, remove them from the portscan list
-A INPUT   -m recent --name portscan --remove
-A FORWARD -m recent --name portscan --remove
 
# These rules add scanners to the portscan list, and log the attempt.
-A INPUT   -p tcp -m tcp --dport 139 -m recent --name portscan --set -j LOG --log-prefix "Portscan:"
-A INPUT   -p tcp -m tcp --dport 139 -m recent --name portscan --set -j DROP
 
-A FORWARD -p tcp -m tcp --dport 139 -m recent --name portscan --set -j LOG --log-prefix "Portscan:"
-A FORWARD -p tcp -m tcp --dport 139 -m recent --name portscan --set -j DROP
 
 
 
 
# Allow SSH
# -A INPUT -p tcp -m state --state NEW --source 8.8.8.8/32 --dport 22 -j ACCEPT
 
 
 
 
# Allow web traffic
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8005 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT
 
 
 
 
# Drop everything else
-A INPUT -j DROP
 
 
 
 
COMMIT

skl/jenkins.md

Creating a new Jenkins Server