2

On one of the old dev servers I manage there is an RSA public and private key pair ~/.ssh/id_rsa.pub and ~/.ssh/id_rsa in a staging user account (used for automation and testing prior to production).

It had been converted into a VPS. Because it is still very much in service, pulling from Bitbucket iterating weekly through many separate but related projects, each on carefully chosen schedules, it is crucial that the same ssh key retain read-write access to those repositories. The QA processes occasionally make robotic updates that git push meta data back up the remote origins. The identity (keys) must not change.

I read through https://confluence.atlassian.com/bitbucket/use-the-ssh-protocol-with-bitbucket-cloud-221449711.html and other online resources but find myself at a loss how to grant this email-less identity write access to new repositories (eg. forks) on difference Bitbucket accounts.

Although I possess the original SSH key for that robot staging account, I don't have access to its Bitbucket account (if any) because I simply don't know which one it is, and have exhausted all possibilities. However its public key cannot be added to any other BB account (using Add key at https://bitbucket.org/account/user/MEMEME/ssh-keys/ ), stating it's already taken.

That is fine; I don't want to link it to the entire account anyway, but only to specific repos under Access management at https://bitbucket.org/USER/PROJECT/admin/access

Trouble is, at that URL one can only submit Bitbucket usernames or working email addresses, not public ssh keys. The dev account setup behind this robot identity has never had its domains' MX records nor mail boxes etc. setup to actually receive email--only enough to satisfy git config from complaining--and I had gone through many possibilities anyway. All bounced back or failed to end up in catch-all boxes.

This leaves me in a bit of a pickle.

Any ideas how given either a pub or priv ssh key, I can find the owner/associated email addresses (even if broken) out in the wild?

The real goal would be to grant this account write access to forked repositories, not the originals.

# ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDYBzHi7y9szZz5um3JLPSYPm3LYTVTzkGl8v58dhiIBDA+8xXlpMJQGFZHT0zmg8+Y+409qQQKzbILcx
T6/rYt5HE57GFNK5DRwaKMCCICabVHF0aJKf9mKlY9fY2TwCZP7ufeISA88pQNQIHpPIuDDy1vFO6yBkkVx8aPIH0q/bvCVE89W+8fpGgdwKq9+dDB0KZp1X
3VMYF0IsJRpH5OGWaQDQHHxJX+sudyWtABlQ3UAgWyp0hkmx1q1kulahk1BrX1wrJOdOrxgpwBnRVHm6dEyJR6j7pK3ZR+4duQqHVkOP//J6RQsdK/voPrSE
z2C0tuuuJn1hBwSJxkn4VN web@staging
  • 1
    How did my pubic key show up in a pastebin, minutes after posting here? pastebin.com/cxB8Wtp3 Another interesting security question. :) – Marcos Apr 8 '16 at 10:33
  • 1
    definitely shady but could be a bot that scans for people posting publickey/privatekey like messages? – d0nut Apr 8 '16 at 10:36
  • 1
    Do the meta data changes show in "recent activity"? That might help you identify the user account. – axl Apr 8 '16 at 11:20
  • @axl Nay, it never makes it past the shell after git push in the first place. "Please make sure you have the correct access rights...." – Marcos Apr 8 '16 at 11:25
  • @axl Your hint is valid. I had referred to the post-fork commits where they are needed. When I checked a pre-fork repo's commit history, one such "Staging Robot" pops up with "Unmapped user. This user is not recognised in Bitbucket." So that's a clue. Though not much I didn't already know. Kind of takes me back to the "who has my key?" question. – Marcos Apr 8 '16 at 11:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.