Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have a website which commits to a git local repository all the changes done.
I need to automatically push them directly from the web server to a remote Bitbucket repository.
The authentication method I use to do it is by passwordless SSH key stored on the Web Server, but I think this could be not so secure.
So the question is... do you know a more secure (or simply better) method to automatically push changes from a Web Server to a Git-Bitbucket private repository?
If you can automatically push, all the secrets have to be on the server. So if someone breaks into that server he will be able to push to hat repository as well. From that point of view there is no difference in SSH passwordless key vs SSH key vs password. You will need to store it on the server that should do the push without interaction.
Repository SSH keys are used to link specific machines to specific repositories. To be able to push automatically, you need either a password-less SSH key or you need to store the password to the password-protected SSH key on the server. Either way, the push can be done without any form of additional authorization/authentication.
So if your webserver is secure, I do not see any security impact (positive or negative) by hooking git push to git commit.
