Ubuntu on Windows 10 - SSH “Permissions xxxx for private key are too open

Question

I have a key file located at C:\private-key.pem and I have a soft link to it on the Ubuntu subsystem: ~/.ssh/private-key.pem -> /mnt/c/private-key.pem.

When I'm trying to ssh into some remote machine from the Ubuntu subsystem, I get:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0777 for '/home/artur/.ssh/private-key.pem' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "/home/artur/.ssh/private-key.pem": bad permissions
Permission denied (publickey).

This began after the 1803 update for Windows: I was trying to use chmod 400 for the key on C:\ and within ~/.ssh on WSL. I trying to set owner to me and remove all other users' ACLs on Windows for this key file, but every time I get Permission denied or
Permissions XXXX for '/home/artur/.ssh/private-key.pem' are too open.

Can anybody help me and explain how keys permissions should be configured on Windows and the Ubuntu subsystem?

I also tried chmod 400 for key on subsystem and set owner just to me from windows security. But the issue still remains same. someone please help. This happened to me with the recent windows 10 update. — sithumc, May 10 '18 at 05:02
Is this your issue https://github.com/Microsoft/WSL/issues/3181? — Biswapriyo, May 14 '18 at 19:37
For me what worked is setting `options = "metadata"` under the automount section in /etc/wsl.conf then running `chmod 600` on the ssh file (check https://devblogs.microsoft.com/commandline/automatically-configuring-wsl/). You also need to log out and log back in and make sure that `C:` now has the automount option in `mount -l` More info about the automount options could be found here: https://devblogs.microsoft.com/commandline/chmod-chown-wsl-improvements/ — Omar.B, Apr 01 '21 at 09:56

anand · Answer 1 · 2018-05-24T17:25:57.950

46

Solution that works for me in windows WSL (without changing file mode):

sudo ssh -i keyfile <user>@ip

edited May 24 '18 at 17:25

answered May 24 '18 at 07:03

anand

593
3
5

19

I don’t understand. Can you explain what you mean? Please do not respond in comments; [edit] your answer to make it clearer and more complete. – Scott - Слава Україні May 24 '18 at 07:26
2

If WSL still shows access permissions for group and others, this is not an acceptable solution. SSH keys must only be accessible to the user they're intended for and no other user or group. Allowing for anything other the 600/400 permissions defeats the purpose of utilizing an SSH key, as it compromises the security of said key. – JW0914 Aug 11 '18 at 12:40
I have no clue how this works, but, this solution works. It may not be the ideal solution(using sudo to ssh, -_-), but, it worked. Some update had messed it up for few months already! Hope it gets fixed. – bozzmob Aug 21 '18 at 14:57
4

I found the right answer here - https://superuser.com/a/1323647/352182 You cannot modify a file inside of /mnt (windows file system), copy the file to your linux and then it works as expected. – bozzmob Aug 21 '18 at 15:00
I agree with @JW0914, doing this compromises the security of the key. JW0914's answer should be the accepted answer. – teuber789 Jun 12 '19 at 18:17
2

For those who don’t get it: _he told you to `sudo` it._ – Константин Ван Aug 05 '19 at 06:39
1

@КонстантинВан `sudo` should _never_ be utilized with `ssh`. The reason why issuing with `sudo` works is because it's now likely being executed as `root`, and this is _not_ the correct way to do this and _is_ a massive security risk, as _Allowing for anything other the 600/400 permissions defeats the purpose of utilizing an SSH key, compromising the security of the key._ – JW0914 Aug 15 '19 at 12:57

score 25 · Answer 2 · edited Oct 29 '19 at 13:01

I'm reading between the lines, and assuming you're using a Linux subsystem in Windows 10. When you symlinked the Windows file from C:\ into the Linux file system in $HOME/.ssh, the permissions of the actual file are still under control of Windows, and the permissions shown to you in the Linux window just best represent the Windows permissions; you can't change the permissions on the Windows files in /mnt/c from Linux. This FAQ from Microsoft talks about how files are handled in the two overlapping file systems.

The file you need to change the permission on is the file the symlink is pointing so, so that means the file in /mnt/c

It doesn't seem possible to give user-only access to a Windows file. Even if you disable permission inheritance on a file and give only your own user read permission, the Linux permissions still show as -r--r--r--, so that won't be usable for ~/.ssh

The only option appears to be copying the file from Windows into Linux, at which point you can use chmod and chown on it.

JW0914 · Answer 3 · 2018-08-04T14:20:34.883

Copy the SSH key over to your WSL ~/.ssh directory, as an SSH key with anything other than 600/400 permissions compromises the key.

Once the key is copied over, ensure it's EOLs have been changed to LF.
- There's a number of ways to do so, from the Atom text editor to CLI solutions like dos2unix, unix2dos, etc.
See @simpleuser's answer below to understand why permissions cannot be changed via Windows, of which necessitates copying the key to the WSL's ~/.ssh directory

score 6 · Answer 4 · edited Dec 22 '20 at 01:16

6

The Windows 10 permissions vs WSL permissions problem is only a problem if the .pem file is in the Windows file system accessible under a mount point, e.g. somewhere in /mnt/c .

If you move the file to under your WSL home directory, e.g. directory /home/.ssh, then you can do a chmod 400 yourkeyfile.pem on the file.

The way WSL works, the standard Linux root directories like bin, etc, home, usr are not visible to Windows 10, hence you can do a chmod on any file just as you were working on a real Linux system.

edited Dec 22 '20 at 01:16

Stephen Rauch

3,091
10
23
26

answered Dec 22 '20 at 00:23

Steven Solomon

161
1
1

I copied it instead of moving it, so both OSs can use it. – aderchox Apr 11 '23 at 08:27

score 3 · Answer 5 · edited Oct 29 '19 at 13:41

I am using Linux Windows Shell on Windows 10 Pro and also installed cygwin

Matching WSL UID to cygwin UID solved the problem.
Find the cygwin UID in the cygwin terminal via id

Two steps to match the UID:

Open cmd.exe with administrator privileges and edit, with the new UID, via regedit.
```
HKCU\Software\Microsoft\Windows\CurrentVersion\Lxss{cefb...cb50}\DefaultUid
```

Change the UID in WSL by using, in the WSL terminal:

sudo vi /etc/passwd
chmod 600 ~/.ssh/private-key.pem

Reference:

score 3 · Answer 6 · edited Aug 28 '20 at 12:40

3

On Windows, delete all others permissions:

```
 chmod 400 'keyname.pem'
```
Right-click keyname.pem → Setting → Security → Delete all users/groups except you.

edited Aug 28 '20 at 12:40

JW0914

7,052
7
27
48

answered May 28 '20 at 09:02

podef01

31
1

Antonio Moreno · Answer 7 · 2023-03-06T14:30:02.987

2

If you are using WSL, you can copy file.pem to ~/.ssh/

Copy file .pem

cp file.pem ~/.ssh/

Change permissions:

chmod 600 ~/.ssh/file.pem

Done, try again with your ssh-add

eval `ssh-agent -s`
ssh-add ~/.ssh/file.pem

edited Mar 06 '23 at 14:30

answered Mar 29 '21 at 12:42

Antonio Moreno

131
2

1

This was the solution I was looking for... chmod 600. Thanks :) – OutOfThisPlanet Jan 25 '23 at 09:46

score 0 · Answer 8 · edited Aug 28 '20 at 12:36

0

To expand on the answer above, I am using Linux Windows Shell on Windows 10 Pro, and the v1803 update broke SSH in the shell.

There is no equivalent to chmod 600 within Windows, but you can leave your .pem unchanged with file permission 777, running the following, which will log straight in (not sure why):
```
sudo ssh -i  'my777Keyfile.pem'  ubuntu@12.34.45.78 
```

edited Aug 28 '20 at 12:36

JW0914

7,052
7
27
48

answered Jun 18 '18 at 12:46

Chris B

31
3

Did you test your answer? I used the GUI in Windows to change the icacl but after some experimentation I couldn't match the Linux SSH requirement that it's restricted down to the ssh user. From memory I always needed to be in at least one group. This meant that I could restrict to (500 or 540 I think) but that still won't work. If I get chance I'll experiment with your method of moving the key to the .shh directory in WSL as that would be a simple and effective solution. – Chris B Aug 02 '18 at 11:59
Since you implied the first two steps in my answer didn't work for you, I've removed them, leaving the last, and only, solution, as SSH keys _should never_ be readable or accessible to any but the user they're intended for. – JW0914 Aug 04 '18 at 14:17

score 0 · Answer 9 · edited Aug 28 '20 at 12:37

0

Here's a really simple WSL solution, normally not requiring sudo:

cat 'mykey.pem' > 'wslkey.pem'
chmod 400 wslkey.pem
ssh -i 'wslkey.pem' ec2-user@[PUBLIC-IP-OF-YOUR-INSTANCE]

edited Aug 28 '20 at 12:37

JW0914

7,052
7
27
48

answered Apr 13 '20 at 09:19

James Shapiro

111
5

score 0 · Answer 10 · answered Sep 18 '20 at 07:46

0

You can use named pipes:

key="/tmp/ssh-$(openssl rand -hex 16)"
mkfifo "${key}"
chmod 600 "${key}"
cat my_key_file_with_bogus_permissions > "${key}" &
ssh-add "${key}"
rm -f "${key}"

answered Sep 18 '20 at 07:46

Alexandru Ast

1

Ubuntu on Windows 10 - SSH “Permissions xxxx for private key are too open

10 Answers10

Linked

Related