Secure Shell Hardening Breaking Change for Project and Repository Scripts

Set report mode

You need administrator access to the Bitbucket server and permission to restart it.

1. Stop Bitbucket.
2. Add the following JVM system property to JVM_SUPPORT_RECOMMENDED_ARGS:
   Copy script

   1

   -Dadaptavist.scriptrunner.bitbucket.sandbox.hardening=report

   If JVM_SUPPORT_RECOMMENDED_ARGS already has values, add this one inside the same quotes, separated by a space.

   Where you set this depends on how you run Bitbucket. See Atlassian's documentation:

   • Setting properties and options on startup (written for Jira, but a similar approach applies to Bitbucket)
   • How to update the JVM configuration for a Windows service
   • How to add JVM arguments and environment variables for Bitbucket Data Center in Kubernetes

   For Docker, pass the property in the JVM_SUPPORT_RECOMMENDED_ARGS environment variable when you start the container.

3. Start Bitbucket.
4. Upgrade ScriptRunner.

If you run a clustered deployment, set the same property on every node, and start each node before you upgrade ScriptRunner.

Review the logs

In report mode, each operation that hardening would block is written to the Bitbucket application log:

• Linux and macOS: <Bitbucket home directory>/log/atlassian-bitbucket.log
• Windows: <Bitbucket home directory>\log\atlassian-bitbucket.log

Each entry is a WARN line containing SR-SANDBOX-HARDENING would block, followed by the name of the affected script and the line number.

Entries appear as your scripts are saved or run, so allow time for your usual repository activity before relying on the results.

To find all report-mode entries on Linux or macOS:

grep "SR-SANDBOX-HARDENING" "<Bitbucket home directory>/log/atlassian-bitbucket.log"

To list each affected script once:

grep "SR-SANDBOX-HARDENING" "<Bitbucket home directory>/log/atlassian-bitbucket.log" | grep -o "script=[^ ]*" | sort -u

On Windows, you can use PowerShell:

Select-String -Path "<Bitbucket home directory>\log\atlassian-bitbucket.log" -Pattern "SR-SANDBOX-HARDENING"

Older entries may be in rotated log files in the same log directory.

Update affected scripts

For each script named in the log, update it so it no longer uses the restricted operation. If you're not sure how to rewrite a script or would like more detail on what's changed, please contact our support team.

Switch back to enforce

When you've updated your scripts, change the property to enforce:

JVM_SUPPORT_RECOMMENDED_ARGS="-Dadaptavist.scriptrunner.bitbucket.sandbox.hardening=enforce"

Then restart Bitbucket. In a clustered deployment, apply the same change on every node.

You can also remove the property entirely, since enforce is the default.

Allow a specific exception

If one of your scripts genuinely needs an operation that hardening blocks, it may be possible to allow that specific operation while keeping all other hardening in place.

To determine whether an exception is appropriate for your setup, please contact our support team. It helps to include the relevant report-mode log entries and the names of the affected scripts, so we can advise on the safest option.

Turn hardening off

If required, you can turn hardening off completely by setting the property to off:

JVM_SUPPORT_RECOMMENDED_ARGS="-Dadaptavist.scriptrunner.bitbucket.sandbox.hardening=off"

Follow the steps in Set report mode, using off instead of report.