nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Is it safe to share App Password?

Bitwise DEVS

I am the admin/owner of the private repos, I want to invite some colleague to collaborate. I enabled pipelines thus 2FA is required and requires me to setup SSH as well. Now I have two option for them to access and be able to push.

1. Invite them using their generated public key and add it on SSH keys page of this account. Thus they will be using SSH remote URL.

2. Generate an App Password and give an HTTPS remote URL in this format

https://<username>:<password>@bitbucket.org/<username>/<repo>.git

With this level of access

Screenshot 2022-01-23 113010.png

Then they will send PRs by logging in using their invited Bitbucket email addresses.

With this approach I am guessing that it is better to give App password per dev, so if I want to revoke someone access others won't be affected. Is it correct?

Accepted answers

Theodora Boudale

Hi @Bitwise DEVS and @Pramodh M,

Please allow me to step into the discussion, summarize some info that has already been provided and explain further a few things.

@Bitwise DEVS Short answer to your questions:

1. It is NOT recommended to add other users' SSH keys to the SSH keys page of your Bitbucket account.
2. It is NOT recommended to give an app password generated for your Bitbucket account to other users.

Both of them pose a security risk. I'll explain below why and what the proper setup should be.

Security risk

Please allow me to explain with an example:

Assume there are two Bitbucket accounts

- account with email email-Admin@domain.com, with Bitbucket username Admin (this is your Bitbucket account)
- account with email email-UserA@domain.com, with Bitbucket username UserA (this is the Bitbucket account of your colleague)

If UserA generates an SSH key pair in their computer, and you add their public key on the page https://bitbucket.org/account/settings/ssh-keys/ of your account, this user automatically gains access to all repos that your account has access to. They will be authenticating with your Bitbucket account, not with theirs.
An app password can be used for authentication in combination with the username. If you generate an app password for your Bitbucket account, it can only be used with your username. If you give your Bitbucket username and your app password to another user, they will again be authenticating with your Bitbucket account, and could access all repos your account has access to.

In our logs, we won't be able to track a certain action (e.g. clone, pull, or push) back to UserA, since the authentication will be made with your user.

These logs are not currently visible to admins, but our team is planning to work on adding clone and push events to a workspace's Audit Log, so admins can also see which user has cloned/pulled/push to their repos: https://jira.atlassian.com/browse/BCLOUD-8322

With a setup like the above, when this feature is implemented, you will see all clones and pushes tied back to your user.

The proper way to set up access

You invite/give access to UserA using the primary email of their Bitbucket account (email-UserA@domain.com).

If you want to give them access to 1 specific repo only, you can invite them from Repository settings > User and group access > Add member.
Alternatively, you can add them to a User group of that workspace by the workspace's Settings > User groups > select the User group you want to add them to (or create a new one) > Add member.

A user group can have access to all workspace's repos, or you can set its default access to None, and then manually add the user group only to repos you want it to have access to.

In both cases, UserA will need to accept the email invitation that will be sent to their email address to gain access.

Afterwards:

a. UserA can create an app password for their Bitbucket account, and use their own username and app-password to interact with repos you have given them access to.
b. Alternatively, they can generate an SSH key pair and add the public key to their account (not to yours).

In both cases a. and b., UserA can interact only with repos they own or have been granted access to.
If you revoke their access from a certain repo/user group of yours, they will no longer be able to access this repo/repos that the user group has access to.
But they will still be able to interact with any other repos owned by them, or repos owned by someone else where they have been invited.

If anything is unclear or if you have any questions, please feel free to let me know.

Kind regards,
Theodora

All comments

Pramodh M_q3eilr

Hi @Bitwise DEVS

Never ever share App Passwords!!

Ask them the SSH Public key and add it in your repo to give them the write access, go with 1st Option.

Or you have an option to invite them as well

If you need to restrict the Branch Permissions, you can do it in branch permissions under the settings of the repository

Let me know if you need any clarification

Thanks,
Pramodh

Bitwise DEVS

May I know the reason? Since anytime we can limit and remove their access as well with App Password I do not see much problem with it or risk.

Bitwise DEVS

And I don't think adding them only as members works, because I already tried it. You still need to add their public key or share an App Password for them to push/pull. Adding them as members only allows them to access the project and create PRs in Bitbucket Cloud.

Pramodh M_q3eilr

Hi @Bitwise DEVS

App Password for one thing is used for Authentication with remote repo or API's

Well, the Secure part depends on how the scope is given if you are okay with your repo being exposed when your App token is shared, that's okay.

And yes, you can revoke it but why manage those access with APIs when you can invite users to the repo itself, right?

To give access to a specific email id or user please go with the user's access option.

And if you need to enforce pull requests, configure branch permissions

Thanks,
Pramodh

Theodora Boudale

Hi @Bitwise DEVS and @Pramodh M,

Please allow me to step into the discussion, summarize some info that has already been provided and explain further a few things.

@Bitwise DEVS Short answer to your questions:

Both of them pose a security risk. I'll explain below why and what the proper setup should be.

Security risk

Please allow me to explain with an example:

Assume there are two Bitbucket accounts

If UserA generates an SSH key pair in their computer, and you add their public key on the page https://bitbucket.org/account/settings/ssh-keys/ of your account, this user automatically gains access to all repos that your account has access to. They will be authenticating with your Bitbucket account, not with theirs.
An app password can be used for authentication in combination with the username. If you generate an app password for your Bitbucket account, it can only be used with your username. If you give your Bitbucket username and your app password to another user, they will again be authenticating with your Bitbucket account, and could access all repos your account has access to.

In our logs, we won't be able to track a certain action (e.g. clone, pull, or push) back to UserA, since the authentication will be made with your user.

With a setup like the above, when this feature is implemented, you will see all clones and pushes tied back to your user.

The proper way to set up access

You invite/give access to UserA using the primary email of their Bitbucket account (email-UserA@domain.com).

If you want to give them access to 1 specific repo only, you can invite them from Repository settings > User and group access > Add member.
Alternatively, you can add them to a User group of that workspace by the workspace's Settings > User groups > select the User group you want to add them to (or create a new one) > Add member.

A user group can have access to all workspace's repos, or you can set its default access to None, and then manually add the user group only to repos you want it to have access to.

In both cases, UserA will need to accept the email invitation that will be sent to their email address to gain access.

Afterwards:

If anything is unclear or if you have any questions, please feel free to let me know.

Kind regards,
Theodora

Bitwise DEVS

This is the best answer, I knew it could be better! Thanks a lot for detailed explanation and giving the correct approach on such case.

Bitwise DEVS

@Theodora Boudale just a follow up question, which is better for them to use? SSH or HTTP? Thanks again!

Theodora Boudale

Hi @Bitwise DEVS ,

You are very welcome!

Both SSH and HTTPS provide a secure connection for transferring data, it's hard to say which one is better.

Some users find SSH easier to use because this way they don't have to manage (app) passwords.
Others prefer HTTPS because they find the process of setting up SSH complicated.
They can try both and see which one works better for them.

Kind regards,
Theodora

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

bitbucket

bitbucket-cloud

bitbucket-pipelines