SSH Private Key Permissions using Git GUI or ssh-keygen are too open
Recently I've been unable to clone or push to github, and I'm trying to find the root cause.
This is on windows
I have cygwin + git as well as msysgit.
Msysgit was installed with the following options:
- OpenSSH
- Use Git from Windows Command Prompt
That gives me 4 environments to try to use git in:
- Windows cmd prompt
- Powershell
- Git Bash
- Cygwin
Somehow I've managed to get myself into a position where when I try to clone a repository using msysgit, cmd.exe, or Powershell, I get the following error:
> Initialized empty Git repository in
> C:/sandbox/SomeProject/.git/
> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> @ WARNING: UNPROTECTED PRIVATE KEY FILE! @
> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> Permissions 0644 for
> '/c/Users/Ben/.ssh/id_rsa' are too
> open. It is recommended that your
> private key files are NOT accessible
> by others. This private key will be
> ignored. bad permissions: ignore key:
> /c/Users/Ben/.ssh/id_rsa Permission
> denied (publickey). fatal: The remote
> end hung up unexpectedly
This is using the .ssh folder in my c:\users\ben\ folder, which is what is used by msysgit. I suspect cygwin works because the .ssh folder is located elsewhere, but I'm not sure why
In Git Bash, I check the permissions:
$ ls -l -a ~/.ssh
Which gives me:
drwxr-xr-x 2 Ben Administ 0 Oct 12 13:09 .
drwxr-xr-x 34 Ben Administ 8192 Oct 12 13:15 ..
-rw-r--r-- 1 Ben Administ 1743 Oct 12 12:36 id_rsa
-rw-r--r-- 1 Ben Administ 399 Oct 12 12:36 id_rsa.pub
-rw-r--r-- 1 Ben Administ 407 Oct 12 13:09 known_hosts
These permissions are apparently too relaxed. How they got this way, I have no idea.
I can try to change them...
$ chmod -v -R 600 ~/.ssh
which tells me:
mode of `.ssh' changed to 0600 (rw-------)
mode of `.ssh/id_rsa' changed to 0600 (rw-------)
mode of `.ssh/id_rsa.pub' changed to 0600 (rw-------)
mode of `.ssh/known_hosts' changed to 0600 (rw-------)
But it seems to have no effect. I still get the same error, and doing
$ ls -l -a ~/.ssh
yields the same permissions as before.
UPDATE:
I tried to fix the permissions to those files in cygwin, and cygwin reports their permissions correctly, gitbash does not: alt text http://cdn.cloudfiles.mosso.com/c54102/app7962031255448924.jpg
Any ideas on how I can really fix these permissions?
Answer
You changed the permissions on the whole directory, which I agree with Splash is a bad idea. If you can remember what the original permissions for the directory are, I would try to set them back to that and then do the following
cd ~/.ssh
chmod 700 id_rsa
inside the .ssh folder. That will set the id_rsa file to rwx (read, write, execute) for the owner (you) only, and zero access for everyone else.
If you can't remember what the original settings are, add a new user and create a set of SSH keys for that user, thus creating a new .ssh folder which will have default permissions. You can use that new .ssh folder as the reference for permissions to reset your .ssh folder and files to.
If that doesn't work, I would try doing an uninstall of msysgit, deleting ALL .ssh folders on the computer (just for safe measure), then reinstalling msysgit with your desired settings and try starting over completely (though I think you told me you tried this already).
Edited: Also just found this link via Google -- Fixing "WARNING: UNPROTECTED PRIVATE KEY FILE!" on Linux While it's targeted at linux, it might help since we're talking liunx permissions and such.