/hudson-war/src/main/webapp/help/system-config/enableSecurity.html

 1<div>
 2  If enabled, you have to login with a username and a password that has the "admin" role
 3  before changing the configuration or running a new build (look for the "login" link
 4  at the top right portion of the page).
 5  Configuration of user accounts is specific to the web container you are using.
 6  (For example, in Tomcat, by default, it looks for <tt>$TOMCAT_HOME/conf/tomcat-users.xml</tt>)
 7
 8  <p>
 9  If you are using Hudson in an intranet (or other "trusted" environment), it's usually
10  desirable to leave this checkbox off, so that each project developer can configure their own
11  project without bothering you.
12
13  <p>
14  If you are exposing Hudson to the internet, you must turn this on. Hudson launches
15  processes, so insecure Hudson is a sure way of being hacked.
16
17  <p>
18  For more information about security and Hudson, see
19  <a href="http://wiki.hudson-ci.org/display/HUDSON/Securing+Hudson">this document</a>.
20</div>