Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to change the permissions to my key file key.pem in Cygwin 1.7.11. It has the permissions flags: -rw-rw----

chmod -c 600 key.pem


mode of 'key.pem' changed from 0660 (rw-rw----) to 0600 (rw-------)


ls -l key.pem 

still reports

key.pem's permission flags are still: -rw-rw----

This reason why I'm asking is that ssh is complaining:

Permissions 0660 for 'key.pem' are too open.

when I try to ssh into my Amazon EC2 instance. Is this an issue with Cygwin & Windows 8 NTFS or am I missing something?

share|improve this question
This sounds like a Win8/Cygwin bug. I'd recommend reporting it on the Cygwin mailing list. – me_and Mar 6 '12 at 10:30
It might be related to NTFS... Windows doesn't really use that Linux scheme. Maybe you can try going into the windows permission settings and only give yourself rights... – sinni800 Mar 7 '12 at 11:11
I think this is related to… – Daniel Stiner Mar 27 '12 at 2:09
up vote 93 down vote accepted

I'm using Cygwin in the Win8CP, and I had the same issue. It's definitely a Cygwin bug, but there's a workaround: try running:

 chgrp -R Users ~/.ssh

The longer explanation is that, for some reason, Cygwin's /etc/passwd and /etc/group generation are putting the user's default/main group as None. And you cannot change the permission of None, so the chmod for group has no effect.

I didn't try repairing the passwd/group files myself, but I did do a chgrp -R Users ~/.ssh (or, if you are on the Windows 8 pre-release, with the group nameHomeUsers). After that, you can do the chmod 0600 and it'll work as expected.

The chgrp to the Users group can be done in whichever other similar cases you find. It even works as expected since Cygwin puts users in the Users group as a secondary group (instead of primary, which would be the correct behavior).

share|improve this answer
I needed chgrp -Rv Users ~/.ssh/* chmod -vR 600 ~/.ssh/* – Tomáš Fejfar Jan 27 '13 at 12:41
@TomášFejfar comment above worked for me. Thanks. – scaraveos Apr 11 '13 at 7:49
@TomášFejfar that was very helpful, maybe it should find its way into install scripts or something – dashesy Jun 1 '13 at 18:11
Note if you have Windows installed in another language Users is not going to work. Use cat /etc/group to check with what you should replace Users. In Dutch for example you would have to replace Users with Gebruikers. – tscheepers Jan 9 '14 at 16:58
It doesn't work anymore. The new solution is @luke-lee 's one. – fjardon Feb 24 '15 at 6:55

Starting from Cygwin 1.7.34 (2015-02-04) the method that changes the group to Users no longer works. Instead you need to use Cygwin's setfacl utility.

  • Say, if you want to set file mode to 644 (rw-r--r--) do this:

    setfacl -s u::rw-,g::r--,o:r--
  • or use a longer format:

    setfacl -s user::rw-,group::r--,other::r--
  • or copy its mode using getfacl from file foo to bar:

    getfacl foo | setfacl -f - bar

A complete manual is in the "setfacl" section of the Cygwin user guide. I wonder why Cygwin has not yet changed chmod utility likewise.

share|improve this answer
solutions with group change to Users didn't work for me but only setfacl based one! – dim Mar 2 '15 at 14:53

Here is a script that uses Luke Lee's suggestion but supports octal args like chmod. It provides a framework that can be extended. although it currently only supports octal args needed to fix permission on key.pem and/or ~/.ssh directory and files.


# convert chmod octal permission args to equivalent setfacl args
ARGS=() ; FILES=()
while [ $# -gt 0 ]; do
  A=$1 ; shift
  case "$A" in
  600|0600) ARGS+=("u::rw-,g::---,o::---") ;;
  640|0640) ARGS+=("u::rw-,g::r--,o::---") ;;
  644|0644) ARGS+=("u::rw-,g::r--,o::r--") ;;
  700|0700) ARGS+=("u::rwx,g::---,o::---") ;;
  *) if [ -e "$A" ]; then FILES+=( "$A" ) ; else
    echo "unrecognized arg [$A]" 1>&2
    exit 1
for F in "${FILES[@]}" ; do
  setfacl -s "${ARGS[@]}" "$F"

I used it like this to fix my .ssh directory and files:

chmodfacl 700 ~/.ssh
chmodfacl 600 ~/.ssh/*
chmodfacl 640 ~/.ssh/*.pub
share|improve this answer
Just got hit by this one in a cygwin update. Thanks for the script. setfacl on its own is horrible. – Andy Brown Feb 14 '15 at 16:32
Thanks for script – dim Mar 2 '15 at 14:52
chgrp -R Users ~/.ssh

chmod 0600 ~/.ssh/config

chmod 0700 ~/.ssh
share|improve this answer
These are the exact steps I needed, +1. – camomileCase Sep 13 '14 at 22:02

If you have git bash installed run the same command (chmod -c 600 key.pem) with git bash and avoid Cygwin.

share|improve this answer

This issue can be resolved by running the ssh-keygen command from the cygwin terminal.(Not the normal windows Command prompt). I have done this in my windows8 machine.

share|improve this answer
Can you please elaborate further? How can this fix the problem? What steps should the user take other than "run ssh-keygen from Cygwin"? – DanteTheEgregore Aug 8 '14 at 15:17
This just generates a key, but the OP has a key with bad permissions – Jonathan Leaders Feb 5 at 16:55

Run the Cygwin installer and update. The bug should be fixed.

share|improve this answer
Your post needs to be expanded. A good answer includes specific instructions (not just links to them) and an explanation as to how or why the answer addresses the OPs question. Please edit your post to adequately address both of these elements. – Twisty Jun 15 '15 at 18:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.