27

Why is 0644 i.e. -rw-r--r-- too open for a SSH key? Also I could not find any false permissions on the .ssh directory (0700) or the home directory (0731).

Btw I'm getting this error when testing the paraphrase of a key via ssh-keygen -y -f my_key.pub

Best regards

Improve this question
9

You may be running ssh-keygen on the wrong file. ssh-keygen -y operates on a private key file. ".pub" files normally contain the public key. You probably have a file there named my_key, without any extension, and it ought to be mode 0600. That is the file which should contain the private key.

To directly answer your question, SSH keys are normally used to permit connecting to remote servers without a password. Possession of the private key would permit someone to log into your account on any system which accepts the key. ssh-keygen and the other ssh utilities require private key files to have restricted permissions because the files are sensitive and need to remain secure.

Improve this answer
22

The only command you need to run is chmod 600 ~/.ssh/id_rsa. That's it.

This changes the permissions on the file so that the owner (you) can read and write it, which will remove the error message you receive.

Improve this answer
3
  • Updated @TwistyImpersonator – niftylettuce Oct 24 '17 at 4:14
  • Thank you! This should be the accepted answer. – lacostenycoder Jan 17 at 4:40
  • Thanks! It worked well for me. :) – Andres Paladines Mar 20 at 2:26
12

0644 in not supposed to be too open for a public key, but is too open for your private key.

Your private key should have permission 0600 while your public key have permission 0644.

By the way, you should also take care of the permission on .ssh folder. It should has the permission 0700, so that only you, the owner, has control over the folder.

As to your home directory, write permission is not supposed to be granted to group and others.

Run chmod go-w /home/username should fix that.

Improve this answer
1
  • 1
    Absolutely do not follow these instructions. This is NOT what you should do. This will also reset all home directory permissions. You should ONLY be modifying the .ssh folder and the id_rsa file itself, not your entire home directory! – niftylettuce Oct 24 '17 at 0:48
0

Answers above are valid but before running any chmod to fix permissions, just make sure your IdentityFile(s) in ~/.ssh/config do refer to your private key. Novices could misundertand that and refer to the public key (with .pub extension) instead, thus leading to that same error (since the public key file permissions are too open for a private key).

Improve this answer
0

I followed the Github instructions and erroneously put the public key as "IdentityFile". Specifying the correct key file fixed this issue for me:

Host *
   AddKeysToAgent yes
   UseKeychain yes
 - IdentityFile ~/.ssh/id_ed25519.pub
 + IdentityFile ~/.ssh/id_ed25519
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.