I created a simple free tier EC2 instance on AWS.

I'm trying to connect to it via SSH on my Windows 10 computer.

I downloaded the key before creating the instance, and stored it in a folder E:\folder

I installed the SSH client and server features on Win10.

The problem: I cannot resolve the permissions issues on my key.

I've googled and checked about 100 links now on the proper way to set up the permissions on my key file, but with everything I've tried, I always get "bad permissions" or "invalid format" accompanied by "Permission denied (publickey)."

Something is wrong with the permissions. I tried CHMOD even with cygwin but it hasn't resolved the issue.

I'm sure I'm missing the simplest thing but I've been racking my brain for a long while now and would really appreciate any assistance.

Thank you kindly,

  • You're not trying to authenticate with the public key portion are you? I've done that out of shear brain-fartiness. – user38537 Jan 30 at 1:25

Keys must only be accessible to the user they're intended for and no other account, service, or group.

OpenSSH needs to be installed from the Win32-OpenSSH GitHub, NOT via Add Features in Windows

  1. Remove the SSH client and server packages you installed via Windows' Add Features.
  2. Install Win32-OpenSSH (as Administrator):
    1. Create your user-specific ssh_config, located at %UserProfile%/.ssh/config (man page)
      Must be done prior to Step 3, else Step 3 will need to be completed again

    2. Set up the system-wide sshd_config, located at %ProgramData%\ssh\sshd_config
      (man page), even if you're not going to utilize the SSH server portion, as the config linked to is more secure than the default
      Must be done prior to Step 3, else Step 3 will need to be completed again

    3. Set up the system-wide default ssh_config, located at %ProgramData%\ssh\ssh_config (man page)
      Must be done prior to Step 3, else Step 3 will need to be completed again

  3. Execute the following scripts to fix permissions (as Administrator):

    powershell.exe -ExecutionPolicy Bypass -File "C:\Program Files\OpenSSH\FixHostFilePermissions.ps1"
    powershell.exe -ExecutionPolicy Bypass -File "C:\Program Files\OpenSSH\FixUserFilePermissions.ps1"
  4. Create the PID file where OpenSSH expects it to be (as Administrator):

    mkdir "C:\Program Files\OpenSSH\appfiles"
    echo > "C:\Program Files\OpenSSH\appfiles\sshd.pid"
  5. Ensure your user's SSH directory (%UserProfile%\.ssh || ~/.ssh) has the correct permissions by following the below instructions:

    Windows / Powershell Terminal

    • GUI:
      • [File] Properties - Security - Advanced
        1. Set Owner to the key's user
        2. Remove all users, groups, and services, except for the key's user, under Permission Entries
        3. Set key's user to Full Control

    • CLI:

      :: Set Variable ::
      set key="C:\Path\to\key"
      set ssh="%UserProfile%\.ssh"
      :: Remove Inheritance ::
      cmd /c icacls %ssh% /c /t /inheritance:d
      cmd /c icacls %key% /c /t /inheritance:d
      :: Set Ownership to Owner ::
      cmd /c icacls %ssh% /c /t /grant %username%:F
      cmd /c icacls %key% /c /t /grant %username%:F
      :: Remove All Users, except for Owner ::
      cmd /c icacls %ssh%  /c /t /remove Administrator BUILTIN\Administrators BUILTIN Everyone System Users
      cmd /c icacls %key%  /c /t /remove Administrator BUILTIN\Administrators BUILTIN Everyone System Users
      :: Verify ::
      cmd /c icacls %ssh%
      cmd /c icacls %key%

    WSL/Cygwin Terminal

    • CLI

      # Set Variables
        # Key  
        # User:
          user="$(echo $USER)"
      # Set Ownership
        # This assumes user's name is also user's group name
          chown $user:$user $key
      # Set Access Rights
        chmod 0600 $key
      # Verify
        ls -l $key

The windows 10 ssh client last year (and likely currently) only supported EdDSA ssh keys, AWS provides and only supports RSA.

Try installing putty and testing ssh with your keypair. If that works and you'd prefer to use the windows 10 ssh client, generate a keypair with the windows 10 client and replace the public key on your ec2 instance.

If that fails, verify the key you have is not missing any dashes on the first or last line.

It should resemble:

(key contents)

5 dashes at each end.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.