19

I'm using the new ssh client for windows 10 and when trying to connect with a private key I'm getting this error:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions for 'MyPair.pem' are too open. It is required that your
private key files are NOT accessible by others. This private key will
be ignored. Load key "MyPair.pem": bad permissions ec2-user@192.0.2.0:
Permission denied (publickey).

I know that if I was on Linux I would need to run chmod 600 to set the file permissions, but what do you use on Windows 10?

1
  • icacls.exe or powershell Set-Acl or read this or this – LotPings Mar 30 '18 at 20:22
20

Keys must only be accessible to the user they're intended for and no other account, service, or group.

  • GUI:
    [File] PropertiesSecurityAdvanced
    1. Owner: The key's user
    2. Permission Entries: Remove all except for the key's user
    3. Set key's user to Full Control

  • CLI:
    # Set Variable:
      Cmd /c Set Key="C:\Path\to\keyfile"
    
    # Remove Inheritance:
      Cmd /c Icacls %Key% /c /t /Inheritance:d
    
    # Set Ownership to Owner:
      Cmd /c Icacls %Key% /c /t /Grant %UserName%:F
    
    # Remove All Users, except for Owner:
      Cmd /c Icacls %Key%  /c /t /Remove Administrator BUILTIN\Administrators BUILTIN Everyone System Users
    
    # Verify:
      Cmd /c Icacls %Key%
    
6
  • GUI is not clear / incomplete. Could you please provide further details? – Seymour Jan 25 '20 at 19:17
  • @Seymour What isn't clear/What are you having issues with? – JW0914 Jan 26 '20 at 4:41
  • That is a bit WAY too generic. It assumes that your remote user is written EXACTLY as the Windows 10 user. 99% improbable in typical scenarios, since Windows has a plethora of users that it needs to work itself (builtin admin, local admin, authenticated users, and so on). That's how security gets bypassed: By making the user too umcomfortable to use it, that he/she will resort to bypass it altogether. – alejandrob Mar 13 '20 at 17:49
  • @alejandrob Remote users must have a Windows account, else there's no authorized_keys file to authenticate against, so I'm not understanding the point you're trying to make. Users listed under "Remove All Users, except for Owner" are the default users generally configured with default access to %UserProfile% subdirectories/files, so there's no point listing other users, groups, or services, as they don't have default access to %UserProfile%\.ssh\authorized_keys. Only users deviating from the default authorized_keys location will need to modify the users to remove access from. – JW0914 Mar 14 '20 at 16:09
  • @JW0914 Indeed. Not just "any" Windows account, but an exactly-named. In my case, Windows arbitrarily decided to name my local user folder as "aleja", and God knows I'm NOT renaming my SSH logins just to to please Windows. It's analogous to a padlock in a knee-high picket-fence: It will harrass only the legitimate owner, while everybody else will just jump over it. I already switched to WAY less cumbersome PuTTYgen. – alejandrob Apr 5 '20 at 3:05
0

Using the Windows 10 GUI, here's some additional detail:

  1. rightclick the pem file, properties, security.
  2. set owner to the key's user (i.e. you)
  3. permission entries, remove all users, groups, services except for the key's user
  4. set key's user to "full control". Here's how I did it:
  5. disable inheritance. if you see a popup, choose to convert to explicit permissions on this file.
  6. Add, select a principal, object type is User, object name is key's owner's username (for example if your home directory is c:\Users\ben folder, then type ben here). OK.
  7. Give that user Full Control
  8. delete everyone else (Authenticated users, system, etc)
  9. OK

It's important that you set the owner to the key's user before you disable inheritance.

2
  • Isn't this the exact same as the answer above it? – JW0914 Jun 27 '20 at 10:54
  • 1
    It has more detail. It should be just a comment to your answer, but superuser.com didn't allow me to add a comment, so the only way I can share the detail is to add as an alternative answer. – Ben Jun 28 '20 at 22:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.