Secure User Plugins

📘
Note
JFrog Workers is the newer, recommended way to easily extend the JFrog Platform (not just Artifactory) in a Cloud-native way. While plugins are supported, we strongly suggest using JFrog Workers whenever possible.

Self-managed JFrog Artifactory provides separate host-level controls for remote plugin deployment and the global plugin infrastructure. Use these controls to limit how Groovy user plugins enter and run in your Artifactory instance.

Only a host operator with access to the server configuration can change these controls. You can't change them through the Platform UI or REST API.

Use the following tasks to secure user plugins:

Disable Plugin Infrastructure
Enable Remote Plugin Deployment
Verify Plugin Security Controls

The following table describes the controls and their defaults.

Control	Default	Behavior
`artifactory.plugin.remote.deploy.enabled`	`false`	Prevents remote plugin deployment. A disabled remote deployment request returns `HTTP 403` before Artifactory writes or loads the submitted script. Existing plugins deployed through the file system can still run while the plugin infrastructure remains enabled.
`artifactory.plugin.infrastructure.enabled`	`true`	Controls the global plugin infrastructure. Setting the value to `false` prevents plugins on disk from loading at startup and skips plugin operations.

Disable Plugin Infrastructure

Disable the global plugin infrastructure if your Artifactory instance doesn't require Groovy user plugins. This control applies to the entire Artifactory instance.

To disable the plugin infrastructure:

Set the following property in the artifactory.system.properties file:
```
artifactory.plugin.infrastructure.enabled=false
```

After the configuration takes effect, Artifactory doesn't load plugins from disk at startup and skips plugin operations.

Enable Remote Plugin Deployment

Remote plugin deployment is disabled by default. Enable it only when an integration requires remote deployment and you trust the source of every submitted script.

❗️
Warning
JFrog strongly recommends against enabling remote plugin deployment to avoid potential impact to underlying systems.

To enable remote plugin deployment:

Set the following property in the artifactory.system.properties file:
```
artifactory.plugin.remote.deploy.enabled=true
```

When the configuration takes effect, Artifactory can accept remote plugin deployment requests. An absent, empty, or malformed property value keeps remote deployment disabled.

Verify Plugin Security Controls

The Artifactory startup log reports whether the plugin infrastructure and remote plugin deployment are enabled. Review this entry after applying a supported configuration change.

To verify the plugin security controls:

Review the Artifactory startup log and confirm that the Plugin infrastructure enabled and remote plugin deploy enabled values match your intended configuration.

Disable Plugin Infrastructure

Enable Remote Plugin Deployment

Verify Plugin Security Controls

Related Topics