Configuring network requirements

4 minute readSecurity

CloudBees CI’s components (the client controller and operations center server) run services that require network communication over several configurable ports. You should open ports according to the services you plan to use.

Defining Inbound (Listening) Ports

Each CloudBees CI component listens for connections on the ports listed below. Many of these ports are used for optional services and can be disabled or enabled according to your needs.

Default Port Example Port 1 Service Configure Description Reference

8080

80

HTTP

Specify the command line option
--httpPort=$HTTP_PORT, where $HTTP_PORT is the new value of this HTTP listening port.
(Specify the value -1 to disable this port.)

When leveraging the built-in Jetty servlet container, a CloudBees CI component defaults to listening on port 8080 for the component’s web application.

Starting and Accessing Jenkins from www.jenkins.io

Disabled

443

HTTPS

Specify the command line option
--httpsPort=$HTTP_PORT, where $HTTP_PORT is the new value of this HTTPS listening port.
(Specify the value -1 to disable this port.)

When leveraging the built-in servlet container, a CloudBees CI component can optionally respond over HTTPS.

Starting and Accessing Jenkins from www.jenkins.io

Disabled or
50000

50000

JNLP

In the CloudBees CI component UI, navigate to:
Manage Jenkins  Configure Global Security  TCP port for JNLP agents

A CloudBees CI component exposes a port for agents to connect via the Java Network Launch Protocol (JNLP). It is also the primary port used by the Jenkins CLI.

operations center uses this port for client controller connectivity.

Distributed Builds from jenkins-ci.org

Random

2222

SSH

In the CloudBees CI component UI, navigate to:
Manage Jenkins  Configure System  SSH Server  SSHD Port

A CloudBees CI component runs an SSH server, exposing a subset of CLI commands and allowing plugins to add functionality over SSH.

A CloudBees CI component optionally uses the SSH port for the Validated Merge plugin.

Jenkins SSH from jenkins-ci.org

9200

HTTP

In the CloudBees CI component UI, navigate to:
Manage Jenkins  Configure Analytics  Analytics  Elasticsearch Configuration  HTTP Port

The Elasticsearch http.port setting. This is an unauthenticated HTTP port, so be careful to ensure it is not exposed to untrusted access.

Analytics from cloudbees.com

9300

TCP

In the CloudBees CI component UI, navigate to:
Manage Jenkins  Configure Analytics  Analytics  Elasticsearch Configuration  Native Port

The Elasticsearch transport.tcp.port setting. This is the bind port for the native Elasticsearch transport client.

Analytics from cloudbees.com

5701

TCP

Hazelcast. A Java library used by CloudBees CI to synchronize controller replicas when running in High Availability mode.

Additional plugins or even your build jobs could run services that open additional ports. Further, running a CloudBees CI component in other Java web containers, Tomcat for example, could open other, container-specific ports.

1 - ports less than 1024 on Linux based systems require a CloudBees CI component to run as root which is not recommended. The Example port column shows examples of how you might configure a CloudBees CI component to appear when fronted by a reverse proxy.

Defining Outbound Ports

For some features, a CloudBees CI component requires outbound access to services on ports as laid out below. Because these are outbound ports which could change, the following table describes the standard ports but your network may run these services on different ports and may require additional configuration.

Standard Port Service Configure Description Reference

25

SMTP

In the CloudBees CI component UI, navigate to:
Manage Jenkins  Configure System  E-mail Notification  SMTP Port

For sending emails from build failures or via other plugins' email functionality, a CloudBees CI component needs access to an SMTP server.

GMail from jenkins-ci.org

389 (636)

LDAP (LDAPS)

In the CloudBees CI component UI, navigate to:
Manage Jenkins  Configure Global Security  Access Control  Security Realm  LDAP  Server

If you plan to authenticate a CloudBees CI component user via an LDAP server, the CloudBees CI component will need access to the LDAP or LDAPS port. When accessing Microsoft Active Directory server, design for access to the Active Directory-specific ports, eg: 3268 for the Global Catalog.

LDAP Plugin from jenkins-ci.org

9200

HTTPS

In the CloudBees CI component UI, navigate to:
Manage Jenkins  Configure Analytics  Analytics  Elasticsearch Configuration  Elasticsearch URLs

operations center's CloudBees Analytics can optionally use an external Elasticsearch instance. If so, operations center will need access to this service on the HTTP port.

Analytics from cloudbees.com

22

ssh

In the CloudBees CI UI, when setting up an ssh agent, under Launch method, select Advanced, and then modify the Port field from its default value of 22. This is helpful if your build agent’s sshd is listening on a different port than the default port 22.

If you are not using ssh-connected build agents, this outbound port is not required to be opened.

CloudBees SSH Build Agents or SSH Build Agents

The CloudBees CI component will require access to additional outbound ports based on the requirements of your jobs and additional plugins you configure.

Setting a Proxy Configuration

If your network uses a web proxy, you will need to configure a CloudBees CI component to enable access to services outside the network. This is important for access to external services, such as the plugin update site or external source control systems, but is not required for the CloudBees CI component to run. You may also need to set some hosts on the network to bypass the proxy, for example your internally resolved binary artifact repository.

Some plugins rely on proxy settings in different locations, so it is best to set each:

Setting Location Examples Reference

In the CloudBees CI component UI, navigate to:
Manage Jenkins  Manage Plugins  Advanced  Proxy

  • Plugin Update Center (core)

  • Git Client Plugin

Jenkins Behind Proxy from www.jenkins.io

  • http.proxyHost, http.proxyPort, http.nonProxyHosts

  • https.proxyHost, https.proxyPort

  • Twitter Plugin

Jenkins Behind Proxy from www.jenkins.io

Plugin Specific Proxy Settings

  • Subversion SCM Plugin

  • Rally Plugin

Jenkins Behind Proxy from www.jenkins.io

2 - These properties should automatically default to the corresponding environment variables (http_proxy, no_proxy), but some Java distributions do not support this default.