Search code examples
encryptionjenkinsmigrationcredentials

Where's the encryption key stored in Jenkins?

I am trying to migrate the credentials from one Jenkins to another but usernames/passwords are hashed in ${JENKINS_HOME}/credentials.xml

I found this answer, but the problem is it doesn't explain where would someone find the encryption key in order to successfully migrate credentials.

Any help is greatly appreciated!

EDIT: More information.. my ${JENKINS_HOME} is on a separate volume which I detach and re-attach onto the new VM, and it still doesn't work with me.

Solution

  • I found this analysis (link is dead as of June 2020, archived here) very helpful. In a nutshell:

    Jenkins uses the master.key to encrypt the key hudson.util.Secret. This key is then used to encrypt the password in credentials.xml.

    When I need to bootstrap new Jenkins instances with some default passwords, I use a template directory tree that contains

    • secrets/hudson.util.Secret and
    • secrets/master.key

    This works fine.