Understanding Beekeeper security warnings

Whenever Beekeeper detects that there is a security warning, the Security Warnings Administrative Monitor will give you the following information:

When you click the number, it shows you the message:

The More Info button takes you to the Security Warnings page of Beekeeper Upgrade Assistant.

In the main page of Beekeeper Upgrade Assistant you can see the same message as in the Security Warnings Administrative Monitor:

There are several ways to reach the Security Warnings page: you can click on the More Info button on the administrative monitor or on the Beekeeper Upgrade Assistant page; or you can click the Security Warnings link on the side panel. On this page you can see all the warnings detected about your instance.

The Vulnerabilities column gives a short description of the security warning, and the link guides you to the published Security Advisory where you can find all of the information about the warning.

The link in the Recommendation column guides you to the release notes / changelog of the compatible plugin with the vulnerability. In case one or more vulnerabilities affect the plugin, the proposed version is the one that fixes all of them.

In case of vulnerabilities affecting CAP plugins or the core of the instance, it shows a link titled Click here to read the release notes for this version that will guide you to the release notes of the product. From here, you can navigate to the Security Advisory with the security warnings that have been fixed in that version.

You can choose what type of security warnings the Security Warnings Administrative Monitor should advise you of. To do that, go to Jenkins  Manage Jenkins  Beekeeper Upgrade Assistant  CAP Configuration. Here you can choose whether or not the Administrative Monitor should notify you in the top menu when warnings related to the product core and / or installed plugins are detected. In any case, the Security Warnings page will show all the vulnerabilities.

More detailed help information can be obtained by clicking on the icon.

The Security Warnings Administrative Monitor retrieves all the security information via HTTP/HTTPS connections, so the first point to check when something is wrong should be the network and the instance’s internet connectivity.

For proper operation, the administrative monitor needs to communicate to https://beekeeper-server.cloudbees.com/api/security-warnings and many elements can affect that communication. The log files will contain information to better diagnose the issue.

When this message is displayed, the Security Warnings Administrative Monitor has detected some kind of error in the network configuration that is preventing the product from connecting to Beekeeper Server.

To diagnose the root cause, look into the log files the SECURITY-WARNING_ERROR: %s message, where %s is the error message. Besides, the points to check would be:

Whether the communication remains down, the Security Warnings Administrative Monitor will automatically deactivate itself.

This message is displayed when similar circumstances to the stated in the previous message happen but the bad configuration issue is in the running instance itself. Once more, to diagnose the root cause, look into the log files the SECURITY-WARNING_ERROR: %s message, where %s is the error message. Besides, the points to check would be:

Whether the Security Warnings Administrative Monitor displays this error, the response retrieved from Beekeeper Server corresponds to a strange situation in the communication. In this case the points to check would be: