SSH key limited to particular IP?

[Oliver]

Hey, I'd like to define an SSH key for my Bitbucket repo access which would be allowed to push from a particular fixed IP (or even a range), but no other. Is that possible?

The rationale here is that I need to automate pushing to the Bitbucket repos for some repos of which the master is located elsewhere. However, I will not upload my unsecured private key to the machine doing this updating. Instead I'd like to create some key and limit its scope. The private key used in automation will obviously have to be without a passphrase.

I know that .ssh/authorized_keys (as used by OpenSSH) allows exactly this behavior, so I am hoping Bitbucket somehow allows to make use of this feature.

Please note: this question is about the Bitbucket service. I do know how to implement this if I have full control of the server-side.

[aMarcus · Accepted solution]

It sounds like you are looking for https://bitbucket.org/site/master/issue/5661/support-openssh-style-host-constraints. We don't have this on our roadmap now, but your comments are welcome on the issue to help us gauge interest.

[Oliver]

Exactly spot on! Thanks.

[Nick Mancuso]

Hey,

SSH keys are already very secure but if you want to limit access to ssh only to a sepcific ip or range of ip's I would simply define it the iptables

it would look something like the following (Where 111.111.111.111 would be the IP of the server take will be connecting)

-A INPUT -s 111.111.111.111 -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT

Good luck!

[Oliver]

Thanks for taking the time to respond, Nick. Perhaps I was unclear about my intention. I am actually looking for this feature on the Bitbucket side. I.e. Bitbucket should only accept this particular key from a particular IP or range of IPs. I could not find it in the account settings, so I am asking here.