Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

So over the years I have had to generate, and use a lot of ssh keys. Some of the things that always have to get done are ~/.ssh needs to be 0700 and ~/.ssh/authorized_keys needs to be 0600, and then private keys used to login to a server always need to be 0600. I know ssh enforces these permissions but I wanted to know the reason why its not safe to have the following (Yes I am calling the white hats, black hats and anything in between to get this answer).

  • ~/.ssh/ = 0755
  • ~/.ssh/authorized_keys = 0644
  • ~/.ssh/id_rsa = 644 (or any private key)
share|improve this question
1  
Um, making your keys world readable means anyone can get your private key, meaning they can log into anything you can . . . –  ernie Aug 1 '13 at 21:56

2 Answers 2

For security reasons....to prevent unauthorized users from obtaining any information that might help break your account.

Remember your security principles, only provide the absolute minimum information (if any) necessary to an outside party to perform a task. The designed set of permissions do that. And ssh is designed to be highly trusted security software.

share|improve this answer

Linux file permissions can be expressed as a three-digit number. Each of the digits represent: Owner, Group, Others.

Digit |  Permissions
------------------------------
0     |  None
1     |  Execute
2     |  Write
3     |  Write and Execute
4     |  Read
5     |  Read and Execute
6     |  Read and Write
7     |  Read, Write and Execute

With 755, you'd give reading and execution permissions to everyone. With 644, you'd be giving reading permissions to everyone.

SSH clients and servers will remind you to use strong permissions to ensure that you don't accidentally share your private key with every user on a server.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.