Bitbucket pull

[Justin Manford]

What is the best security to implement between Bitbucket Cloud and my on premise Linux server as far as transferring code and files back and forth? Ideally we want the request to originate from our on premise Linux server to our repository in Bitbucket Cloud so we don't have to open inbound ssh and sftp ports on our firewall.  Does anyone have experience doing this?

Thanks

Justin 

[Theodora Boudale]

Hi Justin and welcome to the community!

I cannot advise you on security practices on your server, I just wanted to mention that if the server is behind a firewall, the following page lists the IP addresses that need to be whitelisted and the ports that Bitbucket uses:

• https://support.atlassian.com/bitbucket-cloud/docs/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall/

Additionally, if your workspace is on the Premium plan you can make use of the "IP allowlisting" so that the repositories on your workspace can be accessed only by specific IPs that you specify. You can check the doc below, specifically the section "Allowlisting IP addresses"

• https://support.atlassian.com/bitbucket-cloud/docs/control-access-to-your-private-content/

Kind regards,
Theodora

[Justin Manford]

What about pipeline runners? Do you know about them? 

[Theodora Boudale]

Hi Justin,

If you use Pipelines Runners on a server behind a firewall, you will need to whitelist the IP ranges listed on this page:

• https://ip-ranges.atlassian.com/

Additionally, if you have a Premium workspace with IP Whitelisting enabled (from workspace's Settings > Access controls), then you must include on the list "IP allowlisting" the IP addresses of your Runner hosts.

Kind regards,
Theodora

[Justin Manford]

Yeah that's not secure. I already know this.  Any organization that would allow that many IPs open to incoming SSH calls into their network would be stupid.  You just don't open inbound SSH.  I could live with outbound where our internal server initiated the call but we are a government agency.  We don't 'whitelist'.  We open communications port by port or by protocol.  Would you allow someone to RDP or SSH into your desktop whenever they wanted to? How about 1000 different IP's SSH or RDP into your desktop? Can't trust a SaaS vendor when you have no control over their security or infrastructure.  I was looking for.   

[Theodora Boudale]

Hi Justin,

If you don't want to allow access to our IPs, you can look into using the Data Center version of Bitbucket instead, which can be installed on your own infrastructure https://www.atlassian.com/software/bitbucket/enterprise/data-center

Kind regards,
Theodora