How do Bamboo remote agents handle SSH keys from SSH and SCP tasks
Platform notice: Server and Data Center only. This article only applies to Atlassian products on the Server and Data Center platforms.
Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Summary
Building or deploying plans that require ssh connections from a remote agent that has lower security restrictions than the builds/deployments that are being executed on that agent might create some concerns on exposure of private ssh keys used in SCP/SSH tasks.
Solution
Bamboo uses a Java library (net.schmizz.ssh) to establish the ssh connection without spawning a native process. This means that the SSH key is not expose on the remote agent filesystem. The key used for establishing the connection will be present only in the remote agent memory for the time of the ssh connection.