a·gen·tic a·gil·i·ty

Mask password in Jenkins when calling TEE

TL;DR; Learn how to securely mask passwords in Jenkins logs when using Team Explorer Everywhere (TEE), preventing sensitive credentials from being exposed during build processes.

Published on
2 minute read
Image
https://nkdagility.com/resources/rG_NN58PQym
Subscribe

When you use the release build plugin in Jenkins to create a new release the plugin inadvertently leaves your password in clear text in the log files. We need to be able to mask password in Jenkins when calling Team Explorer Everywhere (TEE) so that we meet security requirements.

As you can imagine working at a bank, they get a little…squirmy… when they see or hear about passwords being stored on viewable in the clear. If you are using TFS to do builds from Jenkins then you are likely using the command line tools that come with Team Explorer Everywhere.

Mask password in Jenkins when calling TEE

If you are also using the Release Plugin and you create a release build then you will see the SCM password that you enter written in the clear in the log. Bit of a shock to my banking colleagues I can tell you. So much so that they called “critical blocker” for the migration to TFVC.

Mask password in Jenkins when calling TEE

However during the… conversation… they did say that they had a plugin installed that was supposed to mask the passwords when you do a build. Armed with that knowledge, and little other knowledge of Jenkins, I dived in to find a solution. Maybe it just needed more configuration…

Mask password in Jenkins when calling TEE

So I looked through the documentation and found that you can set variables for passwords and send the variable instead. The plugin will then mask it correctly…. So I thought… that’s for me!

Mask password in Jenkins when calling TEE

So I dutifully created a global password veriable called “MrHinshPas” (yes, I am testing with my own account) and once saved I should be able to use “$(MrHinshPass)” in places where I want the password replaced.

Mask password in Jenkins when calling TEE

Running another build and, wohoo, the password gets replaced.

However why do I need to create a variable for this occurrence when it usually replaced things for other passwords in the list. So I went hunting around… I looked at server configuration. I looked at plugins and documentation.

Eventually I looked in the build configuration and I found this…

Mask password in Jenkins when calling TEE

So for each specific job you can activate the “Mask passwords” option in the Build Environment section and all passwords are magically hidden in your builds. Awesome! How did I miss that…

Smart Classifications

Each classification [Concepts, Categories, & Tags] was assigned using AI-powered semantic analysis and scored across relevance, depth, and alignment. Final decisions? Still human. Always traceable. Hover to see how it applies.

Subscribe

Connect with Martin Hinshelwood

If you've made it this far, it's worth connecting with our principal consultant and coach, Martin Hinshelwood, for a 30-minute 'ask me anything' call.

Our Happy Clients​

We partner with businesses across diverse industries, including finance, insurance, healthcare, pharmaceuticals, technology, engineering, transportation, hospitality, entertainment, legal, government, and military sectors.​

DFDS Logo

DFDS

Genus Breeding Ltd Logo

Genus Breeding Ltd

Freadom Logo

Freadom

MacDonald Humfrey (Automation) Ltd. Logo

MacDonald Humfrey (Automation) Ltd.

Higher Education Statistics Agency Logo

Higher Education Statistics Agency

Teleplan Logo

Teleplan

Brandes Investment Partners L.P. Logo

Brandes Investment Partners L.P.

Jack Links Logo

Jack Links

Cognizant Microsoft Business Group (MBG) Logo

Cognizant Microsoft Business Group (MBG)

Bistech Logo

Bistech

Trayport Logo

Trayport

Flowmaster (a Mentor Graphics Company) Logo

Flowmaster (a Mentor Graphics Company)

Deliotte Logo

Deliotte

Healthgrades Logo

Healthgrades

Milliman Logo

Milliman

Qualco Logo

Qualco

Lean SA Logo

Lean SA

Schlumberger Logo

Schlumberger

Washington Department of Enterprise Services Logo

Washington Department of Enterprise Services

Ghana Police Service Logo

Ghana Police Service

New Hampshire Supreme Court Logo

New Hampshire Supreme Court

Royal Air Force Logo

Royal Air Force

Nottingham County Council Logo

Nottingham County Council

Washington Department of Transport Logo

Washington Department of Transport

Graham & Brown Logo

Graham & Brown

Philips Logo

Philips

MacDonald Humfrey (Automation) Ltd. Logo

MacDonald Humfrey (Automation) Ltd.

Jack Links Logo

Jack Links

Genus Breeding Ltd Logo

Genus Breeding Ltd

Lean SA Logo

Lean SA