Understanding Beekeeper security warnings

The Security Warnings Administrative Monitor shows all published security warnings affecting your current installation. These warnings can apply to the product core itself or to any installed plugins. The Security Warnings Administrative Monitor recommends an update path for you to follow to make your installation secure.

If the warning is related to the product core, Beekeeper suggests updating the instance to mitigate the problem.
If the warning is affecting a plugin inside CloudBees Assurance Program (CAP), Beekeeper also suggests updating to a newer version.
If the warning concerns a compatible plugin, Beekeeper suggests updating that plugin to the version that fixes the problem.

Security Warnings Administrative Monitor

When Beekeeper detects that there is a security warning, the Security Warnings Administrative Monitor provides you with the following information in the CloudBees CI banner at the top of the page:

Figure 1. Security Warnings Administrative Monitor: Number of messages

When you select the icon, it shows you the message:

Figure 2. Security Warnings Administrative Monitor: Messages

The More Info button takes you to the Security Warnings page of the Beekeeper Upgrade Assistant.

Beekeeper Upgrade Assistant

On the main page of the Beekeeper Upgrade Assistant, you can view the same message as in the Security Warnings Administrative Monitor:

Figure 3. Beekeeper Upgrade Assistant

Security Warnings page

Navigate to the Security Warnings page by any of the following methods:

Select More Info on the administrative monitor.
Select More Info on the Beekeeper Upgrade Assistant page.
Select Security Warnings in the left pane.

On this page you can view all the warnings detected about your instance:

Figure 4. Security Warnings page

The Vulnerabilities column provides a short description of the security warning, and the link guides you to the published Security Advisory where you can find all the information about the warning.
The link in the Recommendation column guides you to the release notes/changelog of the compatible plugin with the vulnerability. In case one or more vulnerabilities affect the plugin, the proposed version is the one that fixes all of them.
If there are vulnerabilities affecting CAP plugins or the core of the instance, you can select Click here to read the release notes for this version to review the CloudBees CI release notes and navigate to the Security Advisory, which has the security warnings that have been fixed in that version.

Deactivate the Security Warnings Administrative Monitor

As with any other administrative monitor, you can deactivate the Security Warnings Administrative Monitor and avoid showing every security warning detected.

To deactivate the Security Warnings Administrative Monitor:

Navigate to Manage Jenkins System.
Scroll down to Administrative monitors configuration, select Administrative monitors, and then clear the Security Warnings Monitor checkbox.

Select Save.

Figure 5. Disable the Security Warnings Monitor

Auto-deactivation of the Security Warnings Administrative Monitor

If the instance cannot download updated information about security warnings after 24 hours, the Security Warnings Administrative Monitor is deactivated

automatically. After fixing the issue that prevented the updated information from being obtained, you can reactivate it again in the Administrative monitors configuration.

Select security warnings to show

You can select the type of security warnings the Security Warnings Administrative Monitor should notify you about in the CloudBees CI banner at the top of the page.

To select the security warnings to show:

Navigate to Manage Jenkins Beekeeper Upgrade Assistant
Select CAP Configuration in the left pane.
Select the security warnings the Administrative Monitor should notify you about in the CloudBees CI banner at the top of the page.

The Security Warnings page displays all detected vulnerabilities.

Figure 6. CAP configuration: Security warnings checks
(Optional) Select the icon to obtain more information:

Figure 7. CAP configuration: Help for security warnings check

Troubleshooting

The Security Warnings Administrative Monitor retrieves all the security information via HTTP/HTTPS connections, so the first point to check when something is wrong should be the network and the instance’s internet connectivity.

For proper operation, the administrative monitor needs to communicate with the Beekeeper Server and many elements can affect that communication. The log files contain information to better diagnose the issue.

Unable to connect to the Beekeeper Server

When this message is displayed, the Security Warnings Administrative Monitor has detected some kind of error in the network configuration that is preventing the product from connecting to the Beekeeper Server.

Figure 8. Unable to connect to the Beekeeper Server

To diagnose the root cause, check the log files and locate the SECURITY-WARNING_ERROR: %s message, where %s is the error message. Complete the following steps to troubleshoot the problem:

If a System proxy is configured, verify it is correctly set.
Verify the Beekeeper Server is not out of reach.
Verify the TLS/SSL configuration in the system is correct.
Determine if there is any other network configuration that can be causing the communication breakdown.

If the communication is not reestablished, the Security Warnings Administrative Monitor automatically deactivates.

Network issues

This message is displayed when similar circumstances occur as the previous error message, but the bad configuration issue is in the running instance itself.

Figure 9. Network issues

To diagnose the root cause, check the log files and locate the SECURITY-WARNING_ERROR: %s message, where %s is the error message. Complete the following steps to troubleshoot the problem:

Navigate to Manage Jenkins System, scroll down to HTTP Proxy Configuration, select Setup, and then verify that the proxy settings are properly configured.
Verify the same network configuration points as the previous error message.

Unexpected error message

If the Security Warnings Administrative Monitor displays this error, the response retrieved from the Beekeeper Server corresponds to an unexpected communication problem.

Figure 10. Unexpected error message

Complete the following steps to troubleshoot the problem:

Check the log files to determine if the SECURITY-WARNING_ERROR: Beekeeper server is responding %d code message is present, where %d is the error code response.
Check the log files to determine if the SECURITY-WARNING_ERROR: %s message is present, where %s is the error message.