How to reset Jenkins security settings from the command line?

The simplest solution is to completely disable security - change true to false in /var/lib/jenkins/config.xml file.

<useSecurity>true</useSecurity>

A one-liner to achieve the same:

sed -i 's/<useSecurity>true<\/useSecurity>/<useSecurity>false<\/useSecurity>/g' /var/lib/jenkins/config.xml

Then just restart Jenkins:

sudo service jenkins restart

And then go to admin panel and set everything once again.

If you in case are running your Jenkins inside a Kubernetes pod and can not run service command, then you can just restart Jenkins by deleting the pod:

kubectl delete pod <jenkins-pod-name>

Once the command was issued, Kubernetes will terminate the old pod and start a new one.

We can reset the password while leaving security on.

The config.xml file in /var/lib/Jenkins/users/admin/ acts sort of like the /etc/shadow file Linux or UNIX-like systems or the SAM file in Windows, in the sense that it stores the hash of the account's password.

If you need to reset the password without logging in, you can edit this file and replace the old hash with a new one generated from bcrypt:

$ pip install bcrypt
$ python
>>> import bcrypt
>>> bcrypt.hashpw("yourpassword", bcrypt.gensalt(rounds=10, prefix=b"2a"))
'YOUR_HASH'

This will output your hash, with prefix 2a, the correct prefix for Jenkins hashes.

Now, edit the config.xml file:

...
<passwordHash>#jbcrypt:REPLACE_THIS</passwordHash>
...

Once you insert the new hash, reset Jenkins:

(if you are on a system with systemd):

sudo systemctl restart Jenkins

You can now log in, and you didn't leave your system open for a second.

1 first check location if you install war or Linux or windows based on that

for example if war under Linux and for admin user

/home/"User_NAME"/.jenkins/users/admin/config.xml

go to this tag after #jbcrypt:

<passwordHash>#jbcrypt:$2a$10$3DzCGLQr2oYXtcot4o0rB.wYi5kth6e45tcPpRFsuYqzLZfn1pcWK</passwordHash>

change this password using use any website for bcrypt hash generator

https://www.dailycred.com/article/bcrypt-calculator

make sure it start with $2a cause this one jenkens uses

step-1 : go to the directory cd .jenkins/secrets then you will get a 'initialAdminPassword'.

step-2 : nano initialAdminPassword

you will get a password

Using bcrypt you can solve this issue. Extending the @Reem answer for someone who is trying to automate the process using bash and python.

#!/bin/bash

pip install bcrypt
yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
yum -y install xmlstarlet

cat > /tmp/jenkinsHash.py <<EOF
import bcrypt
import sys

if not sys.argv[1]:
  sys.exit(10)

plaintext_pwd=sys.argv[1]
encrypted_pwd=bcrypt.hashpw(sys.argv[1], bcrypt.gensalt(rounds=10, prefix=b"2a"))
isCorrect=bcrypt.checkpw(plaintext_pwd, encrypted_pwd)

if not isCorrect:
   sys.exit(20);

print "{}".format(encrypted_pwd)
EOF

chmod +x /tmp/jenkinsHash.py
cd /var/lib/jenkins/users/admin*
pwd
while (( 1 )); do
    echo "Waiting for Jenkins to generate admin user's config file ..."

    if [[ -f "./config.xml" ]]; then
        break
    fi

    sleep 10
done

echo "Admin config file created"

admin_password=$(python /tmp/jenkinsHash.py password 2>&1)

# Repalcing the new passowrd
xmlstarlet -q ed --inplace -u "/user/properties/hudson.security.HudsonPrivateSecurityRealm_-Details/passwordHash" -v '#jbcrypt:'"$admin_password" config.xml

# Restart
systemctl restart jenkins
sleep 10

I have kept password hardcoded here but it can be a user input depending upon the requirement. Also make sure to add that sleep otherwise any other command revolving around Jenkins will fail.

To very simply disable both security and the startup wizard, use the JAVA property:

-Djenkins.install.runSetupWizard=false

The nice thing about this is that you can use it in a Docker image such that your container will always start up immediately with no login screen:

# Dockerfile
FROM jenkins/jenkins:lts
ENV JAVA_OPTS -Djenkins.install.runSetupWizard=false

Note that, as mentioned by others, the Jenkins config.xml is in /var/jenkins_home in the image, but using sed to modify it from the Dockerfile fails, because (presumably) the config.xml doesn't exist until the server starts.

I will add some improvements based on the solution:

• https://stackoverflow.com/a/51255443/5322871

On my scenario it was deployed with Swarm cluster with nfs volume, in order to perform the password reset I did the following:

• Attach to the pod:

$ docker exec -it <pod-name> bash

• Generate the hash password with python (do not forget to specify the letter b outside of your quoted password, the method hashpw requires a parameter in bytes):

$ pip install bcrypt
$ python
>>> import bcrypt
>>> bcrypt.hashpw(b"yourpassword", bcrypt.gensalt(rounds=10, prefix=b"2a"))
'YOUR_HASH'

• Once inside the container find all the config.xml files:

$ find /var/ -type f -iname "config.xml"

• Once identified, modify value of the field ( on my case the config.xml was in another location):

$ vim /var/jenkins_home/users/admin_9482805162890262115/config.xml

...
<passwordHash>#jbcrypt:YOUR_HASH</passwordHash>
...

• Restart the service:

docker service scale <service-name>=0
docker service scale <service-name>=1

Hope this can be helpful for anybody.

A lot of times you wont be having permissions to edit the config.xml file.

The simplest thing would be to take a back of config.xml and delete using sudo command.

Restart the jenkins using the command sudo /etc/init.d/jenkins restart

This will disable all the security in the Jenkins and the login option would disappear

For one who is using macOS, the new version just can be installed by homebrew. so for resting, this command line must be using:

brew services restart jenkins-lts

The directory where the file is located config.xml in windows

C:\Windows\System32\config\systemprofile\AppData\Local\Jenkins\.jenkins