title: How do I enable security for Jenkins JNLP slaves?
body: <p>This seems like an obvious question, but I've looked high and low and can't find an answer.  Here's the situation:</p>
  
  <ol>
  <li>I am running a Jenkins continuous integration server on the public Internet with (trusted) volunteers running slaves on a mixture of Windows and Linux machines</li>
  <li>We are using the JNLP (Web start) doodad to start slaves to avoid firewall issues and setting up/debugging ssh</li>
  <li>The server is set up with Matrix-Based security</li>
  </ol>
  
  <p>The trouble is, I can find exactly zero information on how security works with JNLP.  If any anonymous read permissions are granted, then anyone in the world can download slave.jar and access the jnlp file at the (easy to guess) URLS on my server, and connect as a slave.  </p>
  
  <p>I discovered that if I revoke all anonymous access, the jnlp file is blocked but slave.jar is still accessible.  </p>
  
  <p>There doesn't seem to be anything particularly secure in the jnlp file, except one long hex number.  Is this setup safe or is there something else I have to do?</p>
  
  <p>It would be nice if visitors could see the recent builds without logging in, but again if I grant read permissions to anonymous, anyone can access the jnlp file.</p>