nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Locking down bitbucket listener to localhost only

DEBS_bc5lrh

I am trying to lock down our server to listen on localhost only and can't seem to find any documentation on the most current version of Bitbucket. Below is a printout of my netstat:

# netstat -an |grep -iw listen
tcp 0 0 127.0.0.1:8005 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:7980 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:8020 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:7990 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:7992 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:5432 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:7993 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:8095 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:7999 0.0.0.0:* LISTEN

As you can see all the Atlassian ports are listening on 127.0.0.1 except for 7990 and 7999 which are served by Bitbucket. I managed to change Crowd and Jira to localhost by modifying their respective server.xml settings and adding address=127.0.0.1 under the connector tag. However, it seems that Bitbucket is no longer using a server.xml for the listener settings and I am unable to find a thread that is more current.

Accepted answers

Christian Glockner

Hi,

You just need to add the server.address property to itbucket.properties, like so:

server.address=127.0.0.1

Restart Bitbucket Server and it will be listening on that IP address only

Cheers,

Christian

Premier Support Engineer

Atlassian

All comments

Christian Glockner

Hi,

You just need to add the server.address property to itbucket.properties, like so:

server.address=127.0.0.1

Restart Bitbucket Server and it will be listening on that IP address only

Cheers,

Christian

Premier Support Engineer

Atlassian

DEBS_bc5lrh

Thank you for taking the time to answer my question, I realize how strange this must seem, but for security reasons this is a requirement of my organization. For reference I found bitbucket.properties in the following location:

/var/atlassian/application-data/bitbucket/shared/bitbucket.properties

I added your suggestion to the end of the file

#>*******************************************************
#> Migrated to database at jdbc:postgresql://localhost:5432/GIT?targetServerType=master
#> Updated on 2020-09-03T09:53:02.626-05:00
#>*******************************************************
jdbc.driver=org.postgresql.Driver
jdbc.url=jdbc:postgresql://localhost:5432/GIT?targetServerType=master
jdbc.user=git
jdbc.password=devel
server.address=127.0.0.1

restarted the service and now 7990 is listening only on localhost.

# netstat -an |grep -iw listen
tcp 0 0 0.0.0.0:5701 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:8005 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:9418 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:7980 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:9200 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:45297 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:8020 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:7990 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:7992 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:5432 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:7993 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:8090 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:39453 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:7999 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:45055 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:8095 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:8000 0.0.0.0:* LISTEN

However, 5701 (hazelcast.network.multicast.port), and 7999 (plugin.ssh.port) are still listening on all addresses.

Per suggestion in another thread, I tried adding the following to my bitbucket.properties and has not changed the listening ports of the above.

hazelcast.network.multicast=false
hazelcast.network.multicast.address=127.0.0.1

As for 7999 or Bitbucket SSH access, below are the settings from my BB server settings screen.

We are only running a single instance of Bitbucket Server, Jira Server, Confluence Server, and Crowd Server with no plans of using the clustering features of the Data Center version for now.

DEBS_bc5lrh

This was resolved with Bitbucket release 7.11 following implementation of suggestion BSERV-12764

Bryan Turner added a comment - 26/Feb/2021 1:19 AM
Bitbucket Server/Data Center 7.11.0 will add a new property, plugin.ssh.address, which can be set in bitbucket.properties to control what address (or addresses; a comma-separated list is supported) SSH should listen on. The default behavior of listening on all addresses remains unchanged. To bind only to localhost, add plugin.ssh.address=127.0.0.1 to bitbucket.properties.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

bitbucket

bitbucket-server