I'm trying to change the permissions to my key file key.pem in Cygwin 1.7.11. It has the permissions flags: -rw-rw----

chmod -c 600 key.pem


mode of 'key.pem' changed from 0660 (rw-rw----) to 0600 (rw-------)


ls -l key.pem 

still reports

key.pem's permission flags are still: -rw-rw----

This reason why I'm asking is that ssh is complaining:

Permissions 0660 for 'key.pem' are too open.

when I try to ssh into my Amazon EC2 instance. Is this an issue with Cygwin & Windows 8 NTFS or am I missing something?

  • This sounds like a Win8/Cygwin bug. I'd recommend reporting it on the Cygwin mailing list.
    – me_and
    Commented Mar 6, 2012 at 10:30
  • It might be related to NTFS... Windows doesn't really use that Linux scheme. Maybe you can try going into the windows permission settings and only give yourself rights...
    – sinni800
    Commented Mar 7, 2012 at 11:11
  • I think this is related to superuser.com/questions/363141/… Commented Mar 27, 2012 at 2:09

7 Answers 7


I'm using Cygwin in the Win8CP, and I had the same issue. It's definitely a Cygwin bug, but there's a workaround: try running:

 chgrp -R Users ~/.ssh

The longer explanation is that, for some reason, Cygwin's /etc/passwd and /etc/group generation are putting the user's default/main group as None. And you cannot change the permission of None, so the chmod for group has no effect.

I didn't try repairing the passwd/group files myself, but I did do a chgrp -R Users ~/.ssh (or, if you are on the Windows 8 pre-release, with the group nameHomeUsers). After that, you can do the chmod 0600 and it'll work as expected.

The chgrp to the Users group can be done in whichever other similar cases you find. It even works as expected since Cygwin puts users in the Users group as a secondary group (instead of primary, which would be the correct behavior).

  • 12
    I needed chgrp -Rv Users ~/.ssh/* chmod -vR 600 ~/.ssh/* Commented Jan 27, 2013 at 12:41
  • @TomášFejfar comment above worked for me. Thanks.
    – scaraveos
    Commented Apr 11, 2013 at 7:49
  • @TomášFejfar that was very helpful, maybe it should find its way into install scripts or something
    – dashesy
    Commented Jun 1, 2013 at 18:11
  • 4
    Note if you have Windows installed in another language Users is not going to work. Use cat /etc/group to check with what you should replace Users. In Dutch for example you would have to replace Users with Gebruikers.
    – thijsai
    Commented Jan 9, 2014 at 16:58
  • 3
    It doesn't work anymore. The new solution is @luke-lee 's one.
    – fjardon
    Commented Feb 24, 2015 at 6:55

Starting from Cygwin 1.7.34 (2015-02-04) the method that changes the group to Users no longer works. Instead you need to use Cygwin's setfacl utility.

  • Say, if you want to set file mode to 644 (rw-r--r--) do this:

    setfacl -s u::rw-,g::r--,o:r-- foo.bar
  • or use a longer format:

    setfacl -s user::rw-,group::r--,other::r-- foo.bar
  • or copy its mode using getfacl from file foo to bar:

    getfacl foo | setfacl -f - bar

A complete manual is in the "setfacl" section of the Cygwin user guide. I wonder why Cygwin has not yet changed chmod utility likewise.

  • 1
    solutions with group change to Users didn't work for me but only setfacl based one!
    – dim
    Commented Mar 2, 2015 at 14:53
  • 2
    Luke, I think you missed a colon in your first code-block after the 'o'. Commented Sep 15, 2017 at 17:45
  • @SeldomNeedy Argh! You are right, corrected accordingly. Thanks!
    – Luke Lee
    Commented Sep 18, 2017 at 1:02
  • 1
    @SeldomNeedy After some more checks I found both syntax works, but the original one (with one colon) is more accurate. The 2nd colon for 'u' and 'g' is for specifying UID and GID. For 'o' there is no such specifier so only one colon is needed.
    – Luke Lee
    Commented Sep 18, 2017 at 1:15

Here is a script that uses Luke Lee's suggestion but supports octal args like chmod. It provides a framework that can be extended. although it currently only supports octal args needed to fix permission on key.pem and/or ~/.ssh directory and files.


# convert chmod octal permission args to equivalent setfacl args
ARGS=() ; FILES=()
while [ $# -gt 0 ]; do
  A=$1 ; shift
  case "$A" in
  600|0600) ARGS+=("u::rw-,g::---,o::---") ;;
  640|0640) ARGS+=("u::rw-,g::r--,o::---") ;;
  644|0644) ARGS+=("u::rw-,g::r--,o::r--") ;;
  700|0700) ARGS+=("u::rwx,g::---,o::---") ;;
  *) if [ -e "$A" ]; then FILES+=( "$A" ) ; else
    echo "unrecognized arg [$A]" 1>&2
    exit 1
for F in "${FILES[@]}" ; do
  setfacl -s "${ARGS[@]}" "$F"

I used it like this to fix my .ssh directory and files:

chmodfacl 700 ~/.ssh
chmodfacl 600 ~/.ssh/*
chmodfacl 640 ~/.ssh/*.pub
  • Just got hit by this one in a cygwin update. Thanks for the script. setfacl on its own is horrible.
    – Andy Brown
    Commented Feb 14, 2015 at 16:32
  • Where do I put the script?
    – Sisir
    Commented Aug 14, 2016 at 10:31
  • the script can go anywhere in your cygwin path. You might create a $HOME/bin directory and put it there, although you'll then need to add it to your path, e.g., in $HOME/.bashrc.
    – philwalk
    Commented Feb 4, 2018 at 0:13
chgrp -R Users ~/.ssh

chmod 0600 ~/.ssh/config

chmod 0700 ~/.ssh
  • These are the exact steps I needed, +1. Commented Sep 13, 2014 at 22:02

If you have git bash installed run the same command (chmod -c 600 key.pem) with git bash and avoid Cygwin.

  • 1
    I am using git bash and have this problem.
    – Calvin
    Commented Mar 23, 2020 at 21:12

This issue can be resolved by running the ssh-keygen command from the cygwin terminal.(Not the normal windows Command prompt). I have done this in my windows8 machine.

  • 4
    Can you please elaborate further? How can this fix the problem? What steps should the user take other than "run ssh-keygen from Cygwin"? Commented Aug 8, 2014 at 15:17
  • This just generates a key, but the OP has a key with bad permissions
    – Jonathan
    Commented Feb 5, 2016 at 16:55
  • Same experience here: chmod / ssh-keygen puts good permission under cygwin, but doesn't do it if I execute them from the windows cmd. (I don't know why though :-) )
    – autra
    Commented Mar 22, 2018 at 8:36

Run the Cygwin installer and update. The bug should be fixed.

  • 3
    Your post needs to be expanded. A good answer includes specific instructions (not just links to them) and an explanation as to how or why the answer addresses the OPs question. Please edit your post to adequately address both of these elements. Commented Jun 15, 2015 at 18:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .