23

I'm using the new ssh client for windows 10 and when trying to connect with a private key I'm getting this error:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions for 'MyPair.pem' are too open. It is required that your
private key files are NOT accessible by others. This private key will
be ignored. Load key "MyPair.pem": bad permissions ec2-user@192.0.2.0:
Permission denied (publickey).

I know that if I was on Linux I would need to run chmod 600 to set the file permissions, but what do you use on Windows 10?

1
  • icacls.exe or powershell Set-Acl or read this or this
    – LotPings
    Mar 30 '18 at 20:22
23

Keys must only be accessible to the user they're intended for and no other account, service, or group.

  • GUI:
    [File] PropertiesSecurityAdvanced
    1. Owner: The key's user
    2. Permission Entries: Remove all except for the key's user
    3. Set key's user to Full Control

  • Cmd:
    ::# Set Key File Variable:
        Set Key="%UserProfile%\.ssh\id_rsa"
    
    ::# Remove Inheritance:
        Icacls %Key% /c /t /Inheritance:d
    
    ::# Set Ownership to Owner:
        Icacls %Key% /c /t /Grant %UserName%:F
    
    ::# Remove All Users, except for Owner:
        Icacls %Key%  /c /t /Remove Administrator BUILTIN\Administrators BUILTIN Everyone System Users
    
    ::# Verify:
        Icacls %Key%
    
    ::# Remove Variable:
        set "Key="
    
    

  • PowerShell:
    # Set Key File Variable:
      New-Variable -Name Key -Value "$env:UserProfile\.ssh\id_rsa"
    
    # Remove Inheritance:
      Icacls $Key /c /t /Inheritance:d
    
    # Set Ownership to Owner:
      Icacls $Key /c /t /Grant $env:UserName:F
    
    # Remove All Users, except for Owner:
      Icacls $Key  /c /t /Remove Administrator BUILTIN\Administrators BUILTIN Everyone System Users
    
    # Verify:
      Icacls $Key
    
    # Remove Variable:
      Remove-Variable -Name Key
    
    

  • WSL/Cygwin:
    # Set Variables:
      # Key File:
        key="/path/to/key"
    
      # User:
        user="$(echo $USER)"
    
    # Set Ownership to Owner: (assumes user's name is also user's group name)
      chown $user:$user $key
    
    # Set Access Rights
      chmod 0600 $key
    
    # Verify
      ls -l $key
    
    
12
  • GUI is not clear / incomplete. Could you please provide further details?
    – Seymour
    Jan 25 '20 at 19:17
  • @Seymour What isn't clear/What are you having issues with?
    – JW0914
    Jan 26 '20 at 4:41
  • That is a bit WAY too generic. It assumes that your remote user is written EXACTLY as the Windows 10 user. 99% improbable in typical scenarios, since Windows has a plethora of users that it needs to work itself (builtin admin, local admin, authenticated users, and so on). That's how security gets bypassed: By making the user too umcomfortable to use it, that he/she will resort to bypass it altogether.
    – alejandrob
    Mar 13 '20 at 17:49
  • 1
    worked via GUI. ran into 'The system cannot find the path specified' errors when running CLI via powershell May 27 at 14:33
  • 1
    @smartexpert It's not operating as expected in PowerShell with cmd /c or cmd /k, but does within a Cmd terminal, so I've updated the answer with separate PowerShell and Cmd sections - thanks for bringing that to my attention =]
    – JW0914
    May 27 at 20:06
0

Using the Windows 10 GUI, here's some additional detail:

  1. rightclick the pem file, properties, security.
  2. set owner to the key's user (i.e. you)
  3. permission entries, remove all users, groups, services except for the key's user
  4. set key's user to "full control". Here's how I did it:
  5. disable inheritance. if you see a popup, choose to convert to explicit permissions on this file.
  6. Add, select a principal, object type is User, object name is key's owner's username (for example if your home directory is c:\Users\ben folder, then type ben here). OK.
  7. Give that user Full Control
  8. delete everyone else (Authenticated users, system, etc)
  9. OK

It's important that you set the owner to the key's user before you disable inheritance.

2
  • Isn't this the exact same as the answer above it?
    – JW0914
    Jun 27 '20 at 10:54
  • 1
    It has more detail. It should be just a comment to your answer, but superuser.com didn't allow me to add a comment, so the only way I can share the detail is to add as an alternative answer.
    – Ben
    Jun 28 '20 at 22:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.