SSH Key Storage and Security

Question

Hi All,

I'm a Bitbucket Administrator, and I have a question about storage of SSH keys.

Location 1: https://bitbucket.org/[organizationname]/workspace/settings/ssh-keys

Location 2: https://bitbucket.org/account/settings/ssh-keys/

Any Admin is able to register new SSH public keys in Location 1, and a user with the corresponding private key is then able to push code to Bitbucket without password prompts - no problem there.

Any User is able to register a new SSH key into Location 2, however Admins are unable to see those keys.

My questions are:

1. Are key creation/removal on the User (Location 2) level auditable events?

2. Is there a way to generate a report that shows all keys across both locations?

Ben · Answer

G'day Michael!

Welcome to the Bitbucket Cloud community!

User-level SSH keys are present in audit logging at the user level (and are only visible to that user) and cannot be queried at the workspace level - more information regarding the events found in the audit log can be found below:

* https://confluence.atlassian.com/bbkb/bitbucket-cloud-audit-log-events-1178872155.html

As for reporting, this is not yet possible within the Bitbucket Cloud product but there is a feature request logged with our developers. Please feel free to Watch this feature request to receive future updates related to it and Vote for it to improve its visibility with regard to customer demand:

* https://jira.atlassian.com/browse/BCLOUD-21183

Cheers!

- Ben (Bitbucket Cloud Support)