一般的な質問

技術的な質問

1. Q: Is there an available workaround if I’m unable to fix SSH connection? What other alternatives do I have to push my code to Bitbucket Cloud?

A: You can configure your connection to Bitbucket Cloud over HTTPS if you are not able to temporarily use SSH. You will first need to create an App Password associated with your user and then update the repository remote URL to use HTTPS protocol for GIT transactions.

https://support.atlassian.com/ja/bitbucket-cloud/docs/using-app-passwords/

また、HTTPS プロトコルでの認証に Access トークンを使用することできます。

https://support.atlassian.com/ja/bitbucket-cloud/docs/access-tokens/

2. Q: How do I know what SSH client I’m currently using?

A: If you are using MacOS, open the terminal and run ssh debug by using the command below:

ssh -v git@bitbucket.org

First line after the command should give you indication what SSH client you are currently using, example OpenSSH_9.0p1. Once you know the client, please refer to our blog for more details on how to update the Bitbucket Cloud host key or change SSH client configuration to restore your connection. If you are not able to identify which SSH client you are using, please feel free to reach out to our support team and we can help you.

3. Q: How can I verify which host key my client is using?

A: You can check which host key your client is using by using our host_key_info command and then comparing the host fingerprints specified in our blog https://bitbucket.org/blog/ssh-host-key-changes.

例:

ssh git@bitbucket.org host_key_info
/Users/user-name/.ssh/config
Enter passphrase for key '/Users/user-name/.ssh/id_rsa': 
You are using host key with fingerprint:
ssh-rsa SHA256:zzXQOXSRBEiUtuE8AikJYKwbHaxvSc0ojez9YXaGp1A

WARNING: The host key your client is using will be removed in the near future.

Please configure your client to trust a new host key.

See https://bitbucket.org/blog/ssh-host-key-changes for more details.

4. Q: I have integration with Bitbucket Cloud and Bamboo and my Bamboo builds stopped running

A: If your Bamboo instance is configured to use trusted keys, your administrator will need to update your configuration to trust the new ECDSA/Ed25519 host keys as described in https://confluence.atlassian.com/bamboo0901/managing-trusted-keys-1188402906.html

新しいキーを追加するには、ブログ記事を参照して公開キーを取得してください。

https://bitbucket.org/blog/ssh-host-key-changes

5. Q: I’m using OpenSSH_XX and I’m no longer able to connect to bitbucket.org, over SSH protocol, what do I need to do to get the connection restored?

A: There are multiple options as to how you can update bitbucket.org fingerprint stored on your local machine.

1. まず古いフィンガー プリントを削除し、安全なネットワークから Bitbucket への SSH 接続を実行して、新しいフィンガープリントを保存します。

   $ ssh-keygen -R bitbucket.org && curl -L https://bitbucket.org/site/ssh >> ~/.ssh/known_hosts

2.  Manually updating your known_hosts file stored on your machine by using an editor of your choice and updating the file with the new fingerprint.

以下のリソースを参考にしてください。

https://www.techrepublic.com/article/how-to-remove-or-update-a-single-entry-from-the-ssh-known-hosts-file/

https://help.dreamhost.com/hc/en-us/articles/217239087-Updating-host-keys

これらの手順のいずれでも接続できない場合、問題はホストキーの変更とは無関係である可能性があります。

6. Q: I’m using SSH-2.0-PuTTY_* and I’m no longer able to connect to Bitbucket Cloud server, over SSH protocol, what do I need to do to restore my connection after you rotated host key?

A:  If you are using PuTTY, then you will need to access the known_hosts file from the system registry.

1. Follow this simplified step-by-step guide in order to delete the existing fingerprint for bitbucket.org from the registry
   https://www.simplified.guide/putty/edit-delete-ssh-hosts-keys

2. Open Git Bash and run the following command

   ”C:\Program Files\PuTTY\plink.exe” git@bitbucket.org

   Make sure to replace the path with the path to plink.exe on your machine, if you have installed PuTTY in a different directory.
   
   

3. You will see a message similar to the following:

   The host key is not cached for this server:  
     bitbucket.org  (port 22)
   You have no guarantee that the server is the computer
   you think it is.
   The server's ssh-ed25519 key fingerprint is:  
     ssh-ed25519 255 SHA256:ybgmFkzwOSotHTHLJgHO0QN8L0xErw6vd0VhFA9m3SM
   If you trust this host, enter "y" to add the key to
   PuTTY's cache and carry on connecting.
   If you want to carry on connecting just once, without
   adding the key to the cache, enter "n".
   If you do not trust this host, press Return to abandon the
   connection.
   Store key in cache? (y/n, Return cancels connection, i for more info)

4. Before entering y, please make sure that the fingerprint you see in the message matches one of the fingerprints listed on this page, in the section SSH Host Keys:
   https://support.atlassian.com/ja/bitbucket-cloud/docs/configure-ssh-and-two-step-verification/

   After confirming that the fingerprint in the prompt matches the new one for bitbucket.org, enter y.

   The new key should now be added to the registry.

7. Q: I’m using SSH-2.0-JSCH-0.1.44 and I’m no longer able to connect to Bitbucket Cloud, over SSH protocol, what do I need to do to restore my connection after you rotated host key?

A: JSch prefers SHA_RSA and while connecting it will try to compare SHA-RSA fingerprint. Since the Bitbucket fingerprint has recently changed, you will need to update known_hosts file stored on your local machine.

Bitbucket フィンガー プリントを更新する方法には、複数の選択肢があります。

By removing the old one first and then simply running the SSH connection to Bitbucket from secure network and store the new fingerprint:

1. known_hostsファイルから古いキーを削除し、新しいキーを追加します

   $ ssh-keygen -R bitbucket.org && curl -L https://bitbucket.org/site/ssh >> ~/.ssh/known_hosts

2.  Manually update your known_hosts file stored on your machine by using an editor of your choice and updating the file with the new fingerprint.

詳細は、以下を参照してください。https://stackoverflow.com/questions/2003419/com-jcraft-jsch-jschexception-unknownhostkey

8. Q: We are using SourceTree for MAC and are connecting via SSH, will I need to make changes to my known_hosts file ?

SourceTree doesn’t support RSA key rotation. If you are a new user connecting for the first time after May 16, 2023, your SSH client will use our newly introduced ECDSA and Ed25519 keys, no manual action will be required on your part.

However if you are an existing user and have been connecting to Bitbucket via SourceTree over SSH for a while, you will need to manually update your .ssh/know_hosts file and add bitbucket.org new RSA fingerprint and remove the old one on or after June 20, 2023 as described in our blog https://bitbucket.org/blog/ssh-host-key-changes .

9. Q: We are using SourceTree for Windows and are connecting via SSH, will I need to make changes to my known_hosts file ?

f you have configured SourceTree to use OpenSSH as an SSH client

(from the menu Tools > Options > tab General), you will need to manually update your .ssh/know_hosts file, add the new fingerprint and remove the old one as described

in our blog https://bitbucket.org/blog/ssh-host-key-changes

If you have configured SourceTree to use PuTTY as an SSH client (from the menu Tools > Options > tab General), then you will need to access the known_hosts file from the system registry.

1. Follow this simplified step-by-step guide in order to delete the existing fingerprint for bitbucket.org from the registry
   https://www.simplified.guide/putty/edit-delete-ssh-hosts-keys

2. Open Git Bash and run the following command

   "C:\Users\username\AppData\Local\SourceTree\app-3.4.12\tools\putty\plink.exe" git@bitbucket.org

   
   Make sure to replace username with the name of your user on this comupter, and 3.4.12 with the version of SourceTree you are using.

3. You will see a message similar to the following

   The host key is not cached for this server:  
     bitbucket.org  (port 22)
   You have no guarantee that the server is the computer
   you think it is.
   The server's ssh-ed25519 key fingerprint is:  
     ssh-ed25519 255 SHA256:ybgmFkzwOSotHTHLJgHO0QN8L0xErw6vd0VhFA9m3SM
   If you trust this host, enter "y" to add the key to
   PuTTY's cache and carry on connecting.
   If you want to carry on connecting just once, without
   adding the key to the cache, enter "n".
   If you do not trust this host, press Return to abandon the
   connection.
   Store key in cache? (y/n, Return cancels connection, i for more info)

4. Before entering y, please make sure that the fingerprint you see in the message matches one of the fingerprints listed in this page, in the section SSH Host Keys:
   https://support.atlassian.com/ja/bitbucket-cloud/docs/configure-ssh-and-two-step-verification/

1. 1. After confirming that the fingerprint in the prompt matches the new one for bitbucket.org, enter y.

      The new key should now be added to the registry and you should be able to continue using SourceTree with PuTTY

10. Q: I used the instructions as per the blog and executed the following command:

$ ssh-keygen -R bitbucket.org && curl https://bitbucket.org/site/ssh >> ~/.ssh/known_hosts

Warning: the ECDSA host key for 'bitbucket.org' differs from the key for the IP address '<IP Address>' Offending key for IP in ~/.ssh/known_hosts:<IP line number> Matching host key in ~/.ssh/known_hosts: <Bitbucket.org line number> Are you sure you want to continue connecting (yes/no)? yes

error : stderr: No ECDSA host key is known for bitbucket.org and you have requested strict checking. Host key verification failed. fatal: Could not read from remote repository.

$ ssh-keygen -R bitbucket.org && sed -i.old -e '/AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/d' ~/.ssh/known_hosts && curl https://bitbucket.org/site/ssh >> ~/.ssh/known_hosts

11. Q: I’m using port 443 instead of default port 22 to connect to bitbucket.org over SSH and run my connection via altssh.bitbucket.org to connect to Bitbucket. How do I update my known_hosts file?

A: You can fetch the altssh.bitbucket.org and add it to a known_hosts file by running the following:

ssh-keygen -R '[altssh.bitbucket.org]:443' && curl https://bitbucket.org/site/ssh | sed 's/bitbucket.org/[altssh.bitbucket.org]:443/' >> ~/.ssh/known_hosts