Locking down bitbucket listener to localhost only
Asked by DEBS:

I am trying to lock down our server to listen on localhost only and can't seem to find any documentation on the most current version of Bitbucket. Below is a printout of my netstat:

```
# netstat -an |grep -iw listen
tcp 0 0 127.0.0.1:8005 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:7980 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:8020 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:7990 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:7992 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:5432 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:7993 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:8095 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:7999 0.0.0.0:* LISTEN
```

As you can see all the Atlassian ports are listening on 127.0.0.1 except for 7990 and 7999 which are served by Bitbucket. I managed to change Crowd and Jira to localhost by modifying their respective server.xml settings and adding address=127.0.0.1 under the connector tag. However, it seems that Bitbucket is no longer using a server.xml for the listener settings and I am unable to find a thread that is more current.


Answers:
author: Christian Glockner
body: Hi,

You just need to add the server.address property to itbucket.properties, like so:

**server.address=127.0.0.1**

Restart Bitbucket Server and it will be listening on that IP address only

Cheers,

Christian

Premier Support Engineer

Atlassian

comments: author: DEBS
body: Thank you for taking the time to answer my question, I realize how strange this must seem, but for security reasons this is a requirement of my organization. For reference I found **bitbucket.properties** in the following location:

**/var/atlassian/application-data/bitbucket/shared/bitbucket.properties**

I added your suggestion to the end of the file

```
#>*******************************************************
#> Migrated to database at jdbc:postgresql://localhost:5432/GIT?targetServerType=master
#> Updated on 2020-09-03T09:53:02.626-05:00
#>*******************************************************
jdbc.driver=org.postgresql.Driver
jdbc.url=jdbc:postgresql://localhost:5432/GIT?targetServerType=master
jdbc.user=git
jdbc.password=devel
server.address=127.0.0.1
```

restarted the service and now 7990 is listening only on localhost.

```
# netstat -an |grep -iw listen
tcp 0 0 0.0.0.0:5701 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:8005 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:9418 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:7980 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:9200 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:45297 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:8020 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:7990 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:7992 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:5432 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:7993 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:8090 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:39453 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:7999 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:45055 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:8095 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:8000 0.0.0.0:* LISTEN
```

However, **5701 (hazelcast.network.multicast.port)** , and **7999 (plugin.ssh.port)** are still listening on all addresses.

Per suggestion in another thread, I tried adding the following to my bitbucket.properties and has not changed the listening ports of the above.

```
hazelcast.network.multicast=false
hazelcast.network.multicast.address=127.0.0.1
```

As for 7999 or Bitbucket SSH access, below are the settings from my BB server settings screen.

![image.png](https://community.atlassian.com/t5/image/serverpage/image-id/119533i94C1B849BDFDD447/image-size/large?v=v2&px=999 "image.png")

We are only running a single instance of Bitbucket Server, Jira Server, Confluence Server, and Crowd Server with no plans of using the clustering features of the Data Center version for now.


author: DEBS
body: This was resolved with Bitbucket release 7.11 following implementation of suggestion [BSERV-12764](http://%20https://jira.atlassian.com/browse/BSERV-12764)
> [Bryan Turner](http://%20https://jira.atlassian.com/secure/ViewProfile.jspa?name=bturner) added a [comment](http://%20https://jira.atlassian.com/browse/BSERV-12764?focusedCommentId=2670320&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-2670320) - 26/Feb/2021 1:19 AM
>
> Bitbucket Server/Data Center 7.11.0 will add a new property, **plugin.ssh.address** , which can be set in **bitbucket.properties** to control what address (or addresses; a comma-separated list is supported) SSH should listen on. The default behavior of listening on all addresses remains unchanged. To bind only to localhost, add plugin.ssh.address=127.0.0.1 to bitbucket.properties.


Tags: bitbucket-server

server