SSH key limited to particular IP?

Oliver February 4, 2013

Hey, I'd like to define an SSH key for my Bitbucket repo access which would be allowed to push from a particular fixed IP (or even a range), but no other. Is that possible?

The rationale here is that I need to automate pushing to the Bitbucket repos for some repos of which the master is located elsewhere. However, I will not upload my unsecured private key to the machine doing this updating. Instead I'd like to create some key and limit its scope. The private key used in automation will obviously have to be without a passphrase.

I know that .ssh/authorized_keys (as used by OpenSSH) allows exactly this behavior, so I am hoping Bitbucket somehow allows to make use of this feature.

Please note: this question is about the Bitbucket service. I do know how to implement this if I have full control of the server-side.

2 answers

1 accepted

1 vote
Answer accepted
aMarcus
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
February 5, 2013

It sounds like you are looking for https://bitbucket.org/site/master/issue/5661/support-openssh-style-host-constraints. We don't have this on our roadmap now, but your comments are welcome on the issue to help us gauge interest.

Oliver February 6, 2013

Exactly spot on! Thanks.

0 votes
Nick Mancuso February 4, 2013

Hey,

SSH keys are already very secure but if you want to limit access to ssh only to a sepcific ip or range of ip's I would simply define it the iptables

it would look something like the following (Where 111.111.111.111 would be the IP of the server take will be connecting)

-A INPUT -s 111.111.111.111 -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT

Good luck!

Oliver February 4, 2013

Thanks for taking the time to respond, Nick. Perhaps I was unclear about my intention. I am actually looking for this feature on the Bitbucket side. I.e. Bitbucket should only accept this particular key from a particular IP or range of IPs. I could not find it in the account settings, so I am asking here.

Suggest an answer

Log in or Sign up to answer
TAGS
AUG Leaders

Atlassian Community Events