SSH Folder Files and Permissions Explained

The ~/.ssh folder holds your SSH keys, known hosts list, and configuration file, and its permissions determine whether SSH will even accept those files. You need the folder set to 700 (owner-only access) and private keys set to 600, with public keys and config files at 644 or 600. If permissions are too open, SSH refuses to use the key and falls back to password authentication or fails entirely.

What Lives in the .ssh Folder

The .ssh directory is created in your home directory the first time you run ssh or generate a key. Its exact contents vary by operating system and how you use SSH, but the core files are consistent:

• id_rsa / id_ed25519 – your private key. Never share it. Permissions must be 600 (read/write for you only).
• id_rsa.pub / id_ed25519.pub – the matching public key. Safe to share; permissions can be 644.
• known_hosts – a list of remote server fingerprints you’ve connected to. Protects against man-in-the-middle attacks. Usually 644.
• config – per-host settings (custom ports, usernames, key paths). Optional, but common. Permissions 600 or 644.
• authorized_keys – on the server side, lists public keys allowed to log in. Must be 600 and owned by the target user.

On Windows, the folder is typically C:\Users\YourName\.ssh; on macOS and Linux it’s /home/yourname/.ssh (or /root/.ssh for root). The same permission rules apply, though Windows handles them via ACLs rather than Unix mode bits.

Why Permissions Matter So Much

SSH is paranoid by design. If any file in the chain is writable by another user, an attacker could replace your private key or inject a malicious host key. OpenSSH enforces strict checks before it will use a key:

• The .ssh directory must not be group- or world-writable.
• Private keys must not be accessible by anyone else.
• On multi-user systems, even a group with read access can cause SSH to reject the key.

When permissions are wrong, you’ll see an error like Permissions 0644 for 'id_rsa' are too open. SSH then ignores that key and tries the next authentication method. If no other method works, you get a password prompt or a connection failure.

Correct Permissions and How to Set Them

Here’s the standard set for a single‑user setup on Linux or macOS:

1. Set the folder to 700: chmod 700 ~/.ssh
2. Set private keys to 600: chmod 600 ~/.ssh/id_ed25519
3. Set public keys, known_hosts, and config to 644 (or 600 for extra paranoia).
4. On the server, ensure ~/.ssh is 700 and authorized_keys is 600.

If you’re using a key with a passphrase, the permissions are the same. The passphrase is stored encrypted inside the private key file; it doesn’t change the file mode.

Common Mistakes and How to Fix Them

The most frequent issue is copying keys with cp or scp, which preserves the original file’s permissions. For example, if you generate a key on one machine (where it’s 600) and copy it to another where the umask is different, it might end up 644. Symptoms:

• “Permissions 0644 for ‘id_rsa’ are too openâ€� – fix with chmod 600.
• “Bad owner or permissions on /home/user/.ssh/configâ€� – fix with chmod 600 on the config file.
• “Could not open a sessionâ€� or “Permission denied (publickey)â€� – often because the server’s authorized_keys has wrong ownership or mode.

Another mistake is putting the .ssh folder on a filesystem mounted with noexec or with ACLs that override Unix permissions. Check with ls -la ~/.ssh and getfacl if needed.

How to Check Current Permissions

Use ls -la ~/.ssh to see the mode bits. The first column shows something like drwx------ for the folder (that’s 700) and -rw------- for private keys (600). If you see rw-r--r-- (644) on a private key, that’s the problem.

On Windows, open PowerShell and run icacls C:\Users\YourName\.ssh to view ACLs. The output should show only your user account with full control. If it lists SYSTEM or Administrators, SSH may still accept it, but for strict security you can remove them with icacls ... /remove.

Security Considerations Beyond Permissions

Permissions are only one layer. Even with 600, your private key is still a file on disk. If an attacker gains root access, they can read it. Best practices:

• Use a strong passphrase on your private key and load it into an agent (ssh-agent).
• Prefer ed25519 keys over RSA for new setups – they’re shorter and faster.
• Never copy a private key to a server you don’t control.
• Regularly rotate keys, especially if you suspect exposure.

Remember that the authorized_keys file on the server is just as critical. If it’s writable by another user, they can add their own public key and log in as you.

Frequently Asked Questions

What does “permissions are too open� mean?

OpenSSH checks that your private key and .ssh folder are not accessible by other users. If the key is world-readable (e.g., 644), SSH assumes the key may be compromised and refuses to use it. The fix is chmod 600 on the key and chmod 700 on the folder.

Can I set the .ssh folder to 755?

Technically yes, but it’s risky. If the folder is world-readable, other users can list your key filenames and possibly read your public keys. More importantly, some SSH versions will reject the key if the folder is group- or world-writable. Stick with 700 for the folder.

Why does my key work on one machine but not another?

Likely because the permissions differ. The key file itself might be 600 on your laptop but 644 after a copy to a server. Check with ls -la and fix with chmod. Also verify the server’s authorized_keys has the correct public key and proper permissions.

Do I need to set permissions on Windows?

Yes. OpenSSH on Windows checks ACLs similarly. If you see “Bad owner or permissionsâ€�, right-click the .ssh folder in File Explorer, go to Properties → Security, and ensure only your user has Full Control. Remove inherited permissions for other users if necessary.

What if I use a key with a passphrase? Do permissions change?

No. The passphrase encrypts the private key on disk, but the file mode is still 600. The passphrase only adds a layer of protection if the file is stolen; it doesn’t replace the need for correct permissions.

Related

• Most Versatile Ryobi Power Tools
• Organize Screenshots Automatically with Power Automate
• Cheap Power Tool Accessories: Worth It or Not?