Security

Image-level security

• No hardcoded credentials, passwords, API keys, or SSH keys tested by pemba
• OS security updates applied at build time
• UFW firewall enabled with restrictive defaults
• fail2ban configured for SSH protection
• Docker daemon on Unix socket only
• Jenkins requires authentication setup on first access

Jenkins security

Jenkins is a high-value target. Before exposing it on any network:

1. Complete the setup wizard — create an admin user with a strong password immediately
2. Restrict port 8080 via your EC2 security group — never open it to 0.0.0.0/0
3. Use HTTPS — place Jenkins behind a reverse proxy (nginx) with a TLS certificate
4. Disable the Jenkins CLI if not needed — it has historically been an attack vector
5. Install the Security plugin and review the built-in security recommendations

AWS credentials

• Use IAM instance profiles — attach a role to your EC2 instance instead of using long-term credentials
• Never run aws configure with IAM user access keys on shared build servers
• Rotate credentials regularly if long-term keys must be used

Terraform state

• Store Terraform state in an S3 backend with server-side encryption enabled
• Use DynamoDB for state locking to prevent concurrent modifications
• Do not commit .tfstate files to version control

Reporting security issues

Contact [email protected] for any security concerns with a NebulaImage product.