11

I'm using the new ssh client for windows 10 and when trying to connect with a private key I'm getting this error:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions for 'MyPair.pem' are too open. It is required that your
private key files are NOT accessible by others. This private key will
be ignored. Load key "MyPair.pem": bad permissions ec2-user@192.0.2.0:
Permission denied (publickey).

I know that if I was on Linux I would need to run chmod 600 to set the file permissions, but what do you use on Windows 10?

  • icacls.exe or powershell Set-Acl or read this or this – LotPings Mar 30 '18 at 20:22
13

Keys must only be accessible to the user they're intended for and no other account, service, or group.

  • GUI:
    • [File] Properties - Security - Advanced
      1. Set Owner to the key's user
      2. Remove all users, groups, and services, except for the key's user, under Permission Entries
      3. Set key's user to Full Control


  • CLI:

    :: # Set Variable ::
    Set Key="C:\Path\to\key"
    
    :: # Remove Inheritance ::
    Cmd /c Icacls %Key% /c /t /Inheritance:d
    
    :: # Set Ownership to Owner ::
    Cmd /c Icacls %Key% /c /t /Grant %UserName%:F
    
    :: # Remove All Users, except for Owner ::
    Cmd /c Icacls %Key%  /c /t /Remove Administrator BUILTIN\Administrators BUILTIN Everyone System Users
    
    :: # Verify ::
    Cmd /c Icacls %Key%
    
|improve this answer|||||
  • GUI is not clear / incomplete. Could you please provide further details? – Seymour Jan 25 at 19:17
  • @Seymour What isn't clear/What are you having issues with? – JW0914 Jan 26 at 4:41
  • That is a bit WAY too generic. It assumes that your remote user is written EXACTLY as the Windows 10 user. 99% improbable in typical scenarios, since Windows has a plethora of users that it needs to work itself (builtin admin, local admin, authenticated users, and so on). That's how security gets bypassed: By making the user too umcomfortable to use it, that he/she will resort to bypass it altogether. – alejandrob Mar 13 at 17:49
  • @alejandrob Remote users must have a Windows account, else there's no authorized_keys file to authenticate against, so I'm not understanding the point you're trying to make. Users listed under "Remove All Users, except for Owner" are the default users generally configured with default access to %UserProfile% subdirectories/files, so there's no point listing other users, groups, or services, as they don't have default access to %UserProfile%\.ssh\authorized_keys. Only users deviating from the default authorized_keys location will need to modify the users to remove access from. – JW0914 Mar 14 at 16:09

Not the answer you're looking for? Browse other questions tagged or ask your own question.