bitbucket unknown user in audit log

[vbustash]

Hello,

I'm noticing an unknown user with RepositoryPushEvent in the audit log. The userrname is fc0b04ffbb2901fb which looks more like an ID or hash.

Could you help understanding what's this?

Thanks,

Bilel

[Jeff Thomas]

The hash for the user name likely represents an access key that's being used to push commits to the repository. Do you use access keys for this repository or project?

For example, the below entry is from a push I did with an access key:

192.168.10.2 | RepositoryPushEvent | 97d5195ab5a3ce7e | 1475851678183 | PROJ/repo | [{"ref":"refs/heads/master","from":"a5665eeb1da5fdec43ea31f6c26fbcf138a01e56","to":"ac8a912df1ca16719d37c4906eb276715d589d5d"}] | @XNYUOMx887x5566x0 | 1on7762

[vbustash]

I don't think we use one. I'll double check. Thanks for your reply Jeff.

[Felix]

Hi Bilel, 

I can't immediately see anything that would explain what you're seeing. 

I'd suggest you raise a support ticket, so that we can collect some more information from you to get to the bottom of the unexplained audit log entries.

Felix 

[vbustash]

I don't think one of our plugins does this. Here below is a list of the plugins we have, do you notice any suspecious one?

also, can you confirm that commits from unknow users will show as "Unknown" in the audit log?

Atlassian Universal Plugin Manager Self-Update Plugin

Bitbucket Look and Feel Plugin

Bitbucket Server Archive Plugin

Bitbucket Server - Auto Unapprove Pull Requests

Bitbucket Server Protect Unmerged Branch Hook

Bitbucket Server Webhook to Jenkins

Bitbucket Web Post Hooks Plugin

Block Unknown

Can't Push This: Prevent Direct Pushes To Specific Branches

Commit Graph

Custom Navigation Plugin

Favourites

Go2Group Hipchat Plugin

HTTP Request Post-Receive Hook for BitBucket Server

Http Request Trigger

pull-request-notifier-for-bitbucket

Reminders for Bitbucket

Repository git operations plugin

Repository Mirror Plugin for Bitbucket Server

Stash Pull Request Settings REST Access

The Tag Maker

user-permissions

Workzone for Bitbucket

Yet Another Commit Checker

[Felix]

It is possible that this the event is raised by a plugin, which uses a Service User. Do you have any plugins installed that might modify repository data or otherwise raise this event?