SSH Private Key Permissions using Git GUI or ssh-keygen are too open

Question

Recently I ve been unable to clone or push to github  and I m trying to find the root cause   This is on windows  I have cygwin   git as well as msysgit   Msysgit was installed with the following options    OpenSSH Use Git from Windows Command Prompt   That gives me 4 environments to try to use git in    Windows cmd prompt Powershell Git Bash Cygwin   Somehow I ve managed to get myself into a position where when I try to clone a repository using msysgit  cmd exe  or Powershell  I get the following error    gt  Initialized empty Git repository in  gt  C  sandbox SomeProject  git   gt                                                          gt       WARNING  UNPROTECTED PRIVATE KEY FILE              gt                                                          gt  Permissions 0644 for  gt    c Users Ben  ssh id rsa  are too  gt  open  It is recommended that your  gt  private key files are NOT accessible  gt  by others  This private key will be  gt  ignored  bad permissions  ignore key   gt   c Users Ben  ssh id rsa Permission  gt  denied  publickey   fatal  The remote  gt  end hung up unexpectedly   This is using the  ssh folder in my c  users ben  folder  which is what is used by msysgit  I suspect cygwin works because the  ssh folder is located elsewhere  but I m not sure why  In Git Bash  I check the permissions     ls -l -a    ssh   Which gives me   drwxr-xr-x    2 Ben      Administ        0 Oct 12 13 09       drwxr-xr-x   34 Ben      Administ     8192 Oct 12 13 15        -rw-r--r--    1 Ben      Administ     1743 Oct 12 12 36 id rsa -rw-r--r--    1 Ben      Administ      399 Oct 12 12 36 id rsa pub     -rw-r--r--    1 Ben      Administ      407 Oct 12 13 09 known hosts   These permissions are apparently too relaxed   How they got this way  I have no idea   I can try to change them       chmod -v -R 600    ssh   which tells me   mode of   ssh  changed to 0600  rw-------  mode of   ssh id rsa  changed to 0600  rw-------  mode of   ssh id rsa pub  changed to 0600  rw-------  mode of   ssh known hosts  changed to 0600  rw-------    But it seems to have no effect   I still get the same error  and doing     ls -l -a    ssh   yields the same permissions as before   UPDATE   I tried to fix the permissions to those files in cygwin  and cygwin reports their permissions correctly  gitbash does not  alt text http   cdn cloudfiles mosso com c54102 app7962031255448924 jpg  Any ideas on how I can really fix these permissions

User · Answer

Unless there is a reason that you want to keep that private/public key pair (id_rsa/id_rsa.pub), or enjoy banging your head on the wall, I'd recommend just recreating them and updating your public key on github.

Start by making a backup copy of your ~/.ssh directory.

Enter the following and respond "y" to whether you want to over write the existing files.

ssh-keygen -t rsa

Copy the contents of the public key to your clipboard. (Below is how you should do it on a Mac).

cat ~/.ssh/id_rsa.pub | pbcopy

Go to your account on github and add this key.

Name: My new public key
Key: <PASTE>

Exit from your terminal and restart a new one.

If you get senseless error messages like "Enter your password" for your public key when you never entered one, consider this start over technique. As you see above, it's not complicated.

User · Answer

I never managed to get git to work completely in Powershell  But in the git bash shell I did not have any permission related issues  and I did not need to set chmod etc     After adding the ssh to Github I was up and running

User · Answer

For  nix systems  the obvious fix is chmod 600 id rsa ofc  but on windows 7 I had to hit my head against the wall for a while  but then I found the magic solution   go to My Computer   Right Click   Properties   Advanced System Settings   Environment Variables and DELETE the variable  possibly from both system and user environment    CYGWIN  Basically  its a flaw in mingw32 used by git windows binary  seeing all files 644 and all folders 755 always  Removing the environment variable does not change that behaviour  but it appearantly tells ssh exe to ignore the problem  If you do set proper permissions to your id rsa through explorers security settings  there really is no need to have any other user in there than your own  not  everyone   not  administrators   not  system   none  just you   you ll still be secure   Now  why mingw32  a different system than cygwin  would make any use of the CYGWIN environment variable  is beyond me  Looks like a bug to me

User · Answer

Changing file permissions from Properties  disabling inheritance and running chmod 400 didn t work for me  The permissions for my private key file were      -r--r----- 1 alex None 1766 Mar  8 13 04  home alex  ssh id rsa   Then I noticed the group was None  so I just ran     chown alex Administrators    ssh id rsa   Then I could successfully change the permissions with chmod 400  and run a git push

User · Answer

For Windows 7 using the Git found here  it uses MinGW  not Cygwin     In the windows explorer  right-click your id rsa file and select Properties Select the Security tab and click Edit    Check the Deny box next to Full Control for all groups EXCEPT Administrators Retry your Git command

User · Answer

My system is a bit of a mess with bash cygwin git msysgit maybe-more     chmod had no effect on the key  or the config file   Then I decided to approach it from Windows  which worked    Right-Click the file whose permission needs fixing  Select Properties  Select the Security tab  Click Advanced near the bottom  Click Change  next to Owner near the top  Type  My-Awesome-Username   obviously change that to your current Windows username   and click Check Names  then OK  Under Permission entries   highlight each user that isn t  My-Awesome-Username   and select Remove  Repeat this until  My-Awesome-Username  is the only one left  Select  My-Awesome-Username   and click Edit below  Make sure the Type  at the top is set to Allow  and then tick the checkbox next to Full control  Hit OK  Apply  OK  OK  Give it another try now      Seems the sometimes the mock-bash can t control the file ownership  It s especially weird  as it s generated from a mock-bash script  Go figure

User · Answer

What did the trick for me was to update CYGWIN environment variable with   tty nodosfilewarning   Didn t even need to chmod the key

User · Answer

I m on XP and this allowed Git Bash to communicate w  Github  after much frustration     copy c  cygwin bin cyg    50 files  to c  Program Files Git bin  copy c  cygwin bin ssh exe to c  Program Files Git bin   overwriting  Create the file c  Documents and Settings  lt username gt   ssh config containing   Host github com     User git     Hostname github com     PreferredAuthentications publickey     IdentityFile   cygdrive c Documents and Settings  lt username gt   ssh id rsa    optional  Use ssh -v git github to see the connection debugged  Try a push    Background  The general problem is a combination of these two    BUG  mingw32 sees all files as 644  other group-readable   and nothing I tried in mingw32  cygwin  or Windows could fix it  mingw32 s SSH version won t allow that for private keys  generally a good policy in a server

User · Answer

I m playing right now with Git 1 6 5  and I can t replicate your setup   Administrator WS2008  k git   ll    ssh total 8 drwxr-xr-x    2 Administ Administ     4096 Oct 13 22 04    drwxr-xr-x    6 Administ Administ     4096 Oct  6 21 36     -rw-r--r--    1 Administ Administ        0 Oct 13 22 04 c txt -rw-r--r--    1 Administ Administ      403 Sep 30 22 36 config disabled -rw-r--r--    1 Administ Administ      887 Aug 30 16 33 id rsa -rw-r--r--    1 Administ Administ      226 Aug 30 16 34 id rsa pub -rw-r--r--    1 Administ Administ      843 Aug 30 16 32 id rsa putty ppk -rw-r--r--    1 Administ Administ      294 Aug 30 16 33 id rsa putty pub -rw-r--r--    1 Administ Administ     1626 Sep 30 22 49 known hosts  Administrator WS2008  k git   git clone git github com alexandrul gitbook git Initialized empty Git repository in k  git gitbook  git  remote  Counting objects  1152  done  remote  Compressing objects  100   625 625   done  remote  Total 1152  delta 438   reused 1056  delta 383 s Receiving objects  100   1152 1152   1 31 MiB   78 KiB s  done  Resolving deltas  100   438 438   done   Administrator WS2008  k git   ssh git github com ERROR  Hi alexandrul  You ve successfully authenticated  but GitHub does not pro vide shell access Connection to github com closed     ssh -v OpenSSH 4 6p1  OpenSSL 0 9 8e 23 Feb 2007   chmod doesn t modify file permissions for my keys either   Environment    Windows Server 2008 SP2 on NTFS user  administrator environment vars    PLINK PROTOCOL ssh HOME  c profiles home    Update  Git 1 6 5 1 works as well

User · Answer

Not a direct answer to the primary question  but on your question of how cygwin s folder works    As a general rule  cygwin puts all of  your  files under the equiv of c  cygwin home username  It treats that folder for any user-specific settings rather than the Windows user directory

User · Answer

There is a bug with cygwin s chmod  please refer to   https   superuser com questions 397288 using-cygwin-in-windows-8-chmod-600-does-not-work-as-expected  chgrp -Rv Users    ssh    chmod -vR 600    ssh id rsa

User · Answer

I solve it running   chmod 400    ssh id rsa   I hope to help  Good luck

User · Answer

koby s answer doesn t work for me  so I make a little change   cd    ssh chmod 700 id rsa pub   This works well for me on Mac

User · Answer

You changed the permissions on the whole directory  which I agree with Splash is a bad idea   If you can remember what the original permissions for the directory are  I would try to set them back to that and then do the following  cd    ssh chmod 700 id rsa   inside the  ssh folder   That will set the id rsa file to rwx  read  write  execute  for the owner  you  only  and zero access for everyone else   If you can t remember what the original settings are  add a new user and create a set of SSH keys for that user  thus creating a new  ssh folder which will have default permissions   You can use that new  ssh folder as the reference for permissions to reset your  ssh folder and files to   If that doesn t work  I would try doing an uninstall of msysgit  deleting ALL  ssh folders on the computer  just for safe measure   then reinstalling msysgit with your desired settings and try starting over completely  though I think you told me you tried this already    Edited  Also just found this link via Google -- Fixing  WARNING  UNPROTECTED PRIVATE KEY FILE   on Linux While it s targeted at linux  it might help since we re talking liunx permissions and such

User · Answer

I had the same issue on Windows 10 where I tried to SSH into a Vagrant box  This seems like a bug in the old OpenSSH version  What worked for me    Install the latest OpenSSH from http   www mls-software com opensshd html where exe ssh    Note the   exe  if you are using Powershell   You might see something like   C  Windows System32 OpenSSH ssh exe C  Program Files OpenSSH bin ssh exe C  opscode chefdk embedded git usr bin ssh exe   Note that in the above example the latest OpenSSH is second in the path so it won t execute   To change the order     Right-click Windows button -  Settings -   Edit the System Environment Variables  On the  Advance  tab click  Environment Variables     Under System Variables edit  Path   Select  C  Program Files OpenSSH bin  and  Move Up  so that it appears on the top  Click OK Restart your Console so that the new environment variables may apply

User · Answer

Did you copy the key file from another machine   I just created an id rsa file on the client machine then pasted the key in I wanted  No permissions issues  Nothing to set  It just worked  It also works if you use PuTTYgen to create the private key   Possibly some hidden group issue if you re copying it from another machine   Tested on two Windows 8 1 machines  Using Sublime Text 3 to copy and paste the private key  Using Git Bash  Git-1 9 4-preview20140611

User · Answer

After comming across the problem recently and this being one of the top google results i thought i would chip in with a simple work around documented in discussion here  http   code google com p msysgit issues detail id 261 c40  Simply involves overwriting the mysys ssh exe with your cygwin ssh exe

User · Answer

OK so here is how I actually forced the change on my Windows files regarding the permissions themselves on Win7  Find your ssh key in windows explorer  C  Users your user name here  ssh id rsa  Right-click on file Properties Security tab Advanced button Change permissions  Now remove everyone that is not actually your username  This includes Administrator and System users  At this point you may get a dialogue about inheriting permissions- choose the option that DOESN T inherit- since we only want to change this file   Click OK and save till done   I fought with this for days because my windows would not change the file permissions from the command line  This way it is also ACTUALLY done- instead of using exciting work arounds that make can have odd consequences

User · Answer

This is a particularly involved problem on Windows  where it s not enough to just chmod the files correctly  You have to set up your environment    On Windows  this worked for me    Install cygwin  Replace the msysgit ssh exe with cygwin s ssh exe  Using cygwin bash  chmod 600 the private key file  which was  id rsa  for me  If it still doesn t work  go to Control Panel -  System Properties -  Advanced -  Environment Variables and add the following environment variable  Then repeat step 3   Variable  nbsp   nbsp   nbsp Value CYGWIN  nbsp   nbsp   nbsp sbmntsec

User · Answer

FOR MAC USERS   Change the settings of your key pair file by typing this in the terminal   chmod og-r  filename pem     make sure you are in the correct directory  or path filename in the command correctly

User · Answer

I had the same problem on Windows XP just recently  I tried to chmod 700 on my    ssh id rsa file but it did not seem to work  When I had a look at the permissions using ls -l on the     ssh id rsa I could see that my effective permissions still was 644   Then I remembered that windows permissions also inherit permissions from the folders  and the folder was still open to everyone  A solution could be to set permissions for the folder as well  but I think a better way would be to tell the system to ignore inheritance for this file  This can be done using the advanced option on the security tab in the properties of the file  and unchecking  inherit from parent permissions      This might be helpful for others with the same problem

User · Answer

Type on terminal   chmod -Rf 700    ssh    And try again

User · Answer

After upgrading my Cygwin installation to a version around February 2015  1 7 34 0 285 5 3  2015-02-04 12 14 x86 64 Cygwin   I suddenly ran into the UNPROTECTED PRIVATE KEY FILE warning   I fixed this problem after running the following command   setfacl -s u  rw- g  --- o ---    ssh id rsa    another answer to another question gives more context

User · Answer

I was able to fix this by doing two things  though you may not have to do step 1    copy from cygwin ssh exe and all cyg  dll into Git s bin directory  this may not be necessary but it is a step I took but this alone did not fix things  follow the steps from  http   zylstra wordpress com 2008 08 29 overcome-herokus-permission-denied-publickey-problem   I added some details to my    ssh config file    Host heroku com Hostname heroku com Port 22 IdentitiesOnly yes IdentityFile    ssh id heroku TCPKeepAlive yes User brandon    I had to use User as my email address for heroku com Note  this means you need to create a key  I followed this to create the key and when it prompts for the name of the key  be sure to specify id heroku http   help github com win-set-up-git    then add the key  heroku keys add    ssh id heroku pub

User · Answer

None of the workarounds suggested here  chmod chgrp setfacl windows perms  worked for me with msys64 on a Windows 7 corporate VM  In the end I worked around the problem by using an ssh agent with the key provided on stdin  Adding this to my  bash profile makes it the default for my login   eval   ssh-agent -s  cat    ssh id rsa   ssh-add -k -   Now I can do git push and pull with ssh remotes

[git] SSH Private Key Permissions using Git GUI or ssh-keygen are too open

Examples related to git

Examples related to ssh

Examples related to cygwin

Examples related to msysgit

Examples related to openssh