Using SSH keys to secure Git operations

Personal SSH keys

You can use SSH keys to establish a secure connection between your computer and Stash for when you are performing read-write Git operations from your local machine. Personal keys are attached to your Stash account – they are bound by that account's permissions and use the account's identity for any operations.

Stash supports DSA and RSA2 key types – RSA1 is not supported. A Stash user can add any number of keys to their account.

Before you can use SSH keys to secure a connection with Stash the following must have already been done:

• your Stash administrator must have already enabled SSH access in Stash.
• you need an SSH key! See Creating SSH keys. Alternatively, you can use an existing key, if it isn't already being used as a repository or project access key.
• you need to have added your personal SSH key to your Stash account – see the following section.

Once you have an SSH key associated with your Stash account, using it is easy! See Use SSH keys to connect to Stash repositories below.

Add an SSH key to your Stash account

1. On Windows, in your command prompt, change directory to your .ssh directory, and copy the public key file to your clipboard by running:

   Windows

   cd %userprofile%/.ssh
   clip < id_rsa.pub

   
   On Mac OS X or Linux simply run the following in a terminal:

   Mac OS X

   pbcopy < ~/.ssh/id_rsa.pub

   Linux

   sudo apt-get install xclip
   xclip -sel clip < ~/.ssh/id_rsa.pub

   Note that on Linux, you may need to download and install xclip, as shown in the code snippet above.

    

2. In Stash, go to your account:
   
   

3. Click on SSH keys and then Add key. 
4. Paste the key into the text box:
   
   
5. Click Add key. You're done!

Use SSH keys to connect to Stash repositories

SSH access needs to have been set up, as described above. Once this is done, you can use SSH keys as follows:

1. Go to Projects, click a project, and choose a repository from the list.
2. Click Clone at the top right to see the clone URLs for the repository.
3. Choose the clone URL you want to use. SSH is available if you have already added an SSH key to your account. If you haven't done that yet, see Add an SSH key to your Stash account, above.
   
    

Project and repository SSH access keys

Stash administrators can set up SSH access keys to allow other systems to perform read-only Git operations on repositories managed in Stash. This allows systems, such as your build and deploy server, to authenticate with Stash to check out and test source code, without having to store user credentials on another system, and without requiring it to link to a specific user account.

• Project admins can add and manage SSH access keys for a project. The keys apply to every repository in the project.
• Repository admins can add and manage SSH access keys for a particular repository.

Stash supports DSA and RSA2 key types – RSA1 is not supported.

Before you can use SSH keys to secure a connection with Stash the following must have already been done: 

• Your Stash administrator must have already enabled SSH access, on Stash.
• You must have already created an SSL key. See Creating SSH keys. Alternatively, you can use an existing key, if it isn't already being used for a personal account.

Using SSH keys to allow access to Stash repositories

To get the SSH key to work with your build, or other, system, you need to:

• Add the private key to that system. For Bamboo, see this page: Shared credentials.
• Add the public key to Stash as described here:

Add an SSH access key to either a Stash project or repository

You simply copy the public key, from the system that you want to have access, and paste it into Stash.

1. Copy the public key. One approach is to display the key on-screen using cat, and copy it from there:

   cat < ~/.ssh/id_rsa.pub

2. Now, in Stash, go to the Settings tab for the project or repository.

3. Click Access keys and then Add key.

4. Paste the key into the text box and click Add key.

Permissions

• Access keys allow read-only access to a project or repository.

Stash license implications

• Access keys do not require an additional Stash user license.

Reusing access keys

• You can use the same SSH access key for multiple repositories or projects.
• Keys used for user accounts can't be re-used as a project or repository access key, and keys used as a project or repository access key can't be re-used for user accounts.