'how to change compromised jenkins node "secret"?

When my jenkins slave starts on its node, the command is run locally from that server:

/bin/java  -jar /usr/local/jenkins/slave.jar \
  -jnlpUrl https://example.com/computer/foo/slave-agent.jnlp \
  -secret <big long hex id>

The "big long hex id" found its way into a git repository and is now compromised. How do I tell my jenkins master to change it?

jenkins

Solution 1:^[1]

If you delete the Slave from Jenkins, then re-add it, it should have a new ID assigned to it.

Solution 2:^[2]

I am guessing that this is using the JNLP protocol and not JNLP4. The classes that generate the secrets: JNLPJnlpSlaveAgentProtocol/JnlpAgentReceiver uses a HMAC which uses the hostname as one input and a secret key as the other input. The secret input is fetched from the "DefaultConfidentialStore" which generates and stores a file in $JENKINS_HOME/secrets/. The name for the file in this case is probably: $JENKINS_HOME/secrets/jenkins.slaves.JnlpSlaveAgentProtocol.secret

To get a different result you either need to change the hostname or remove that file (a new one will be auto generated).

Links:

https://javadoc.jenkins-ci.org/jenkins/security/DefaultConfidentialStore.html

https://javadoc.jenkins-ci.org/jenkins/slaves/JnlpAgentReceiver.html

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution	Source
Solution 1	Jason Swager
Solution 2	LordCrocket

'how to change compromised jenkins node "secret"?

Solution 1:[1]

Solution 2:[2]

Sources

Related Questions

Solution 1:^[1]

Solution 2:^[2]