SSH Private Key Permissions using Git GUI or ssh-keygen are too open

user_3381 0
Viewed 278353

Recently I've been unable to clone or push to github, and I'm trying to find the root cause.

This is on windows

I have cygwin + git as well as msysgit.

Msysgit was installed with the following options:

  • OpenSSH
  • Use Git from Windows Command Prompt

That gives me 4 environments to try to use git in:

  • Windows cmd prompt
  • Powershell
  • Git Bash
  • Cygwin

Somehow I've managed to get myself into a position where when I try to clone a repository using msysgit, cmd.exe, or Powershell, I get the following error:

> Initialized empty Git repository in
> C:/sandbox/SomeProject/.git/
> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> @    WARNING: UNPROTECTED PRIVATE KEY FILE!          @
> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> Permissions 0644 for
> '/c/Users/Ben/.ssh/id_rsa' are too
> open. It is recommended that your
> private key files are NOT accessible
> by others. This private key will be
> ignored. bad permissions: ignore key:
> /c/Users/Ben/.ssh/id_rsa Permission
> denied (publickey). fatal: The remote
> end hung up unexpectedly

This is using the .ssh folder in my c:\users\ben\ folder, which is what is used by msysgit. I suspect cygwin works because the .ssh folder is located elsewhere, but I'm not sure why

In Git Bash, I check the permissions:

$ ls -l -a ~/.ssh

Which gives me:

drwxr-xr-x    2 Ben      Administ        0 Oct 12 13:09 .    
drwxr-xr-x   34 Ben      Administ     8192 Oct 12 13:15 ..    
-rw-r--r--    1 Ben      Administ     1743 Oct 12 12:36 id_rsa
-rw-r--r--    1 Ben      Administ      399 Oct 12 12:36 id_rsa.pub    
-rw-r--r--    1 Ben      Administ      407 Oct 12 13:09 known_hosts

These permissions are apparently too relaxed. How they got this way, I have no idea.

I can try to change them...

$ chmod -v -R 600 ~/.ssh

which tells me:

mode of `.ssh' changed to 0600 (rw-------)
mode of `.ssh/id_rsa' changed to 0600 (rw-------)
mode of `.ssh/id_rsa.pub' changed to 0600 (rw-------)
mode of `.ssh/known_hosts' changed to 0600 (rw-------)

But it seems to have no effect. I still get the same error, and doing 

$ ls -l -a ~/.ssh

yields the same permissions as before.

UPDATE:

I tried to fix the permissions to those files in cygwin, and cygwin reports their permissions correctly, gitbash does not: alt text http://cdn.cloudfiles.mosso.com/c54102/app7962031255448924.jpg

Any ideas on how I can really fix these permissions?

openssh cygwin ssh msysgit git
25 Answers

I had the same issue on Windows 10 where I tried to SSH into a Vagrant box. This seems like a bug in the old OpenSSH version. What worked for me:

  1. Install the latest OpenSSH from http://www.mls-software.com/opensshd.html
  2. where.exe ssh

(Note the ".exe" if you are using Powershell)

You might see something like:

C:\Windows\System32\OpenSSH\ssh.exe
C:\Program Files\OpenSSH\bin\ssh.exe
C:\opscode\chefdk\embedded\git\usr\bin\ssh.exe

Note that in the above example the latest OpenSSH is second in the path so it won't execute.

To change the order:

  1. Right-click Windows button -> Settings -> "Edit the System Environment Variables"
  2. On the "Advance" tab click "Environment Variables..."
  3. Under System Variables edit "Path".
  4. Select "C:\Program Files\OpenSSH\bin" and "Move Up" so that it appears on the top.
  5. Click OK
  6. Restart your Console so that the new environment variables may apply.
user_17411070

My system is a bit of a mess with bash/cygwin/git/msysgit/maybe-more...

chmod had no effect on the key, or the config file.

Then I decided to approach it from Windows, which worked.

  1. Right-Click the file whose permission needs fixing.
  2. Select Properties.
  3. Select the Security tab.
  4. Click Advanced near the bottom.
  5. Click Change, next to Owner near the top.
  6. Type "My-Awesome-Username" (obviously change that to your current Windows username), and click Check Names, then OK.
  7. Under Permission entries:, highlight each user that isn't "My-Awesome-Username", and select Remove. Repeat this until "My-Awesome-Username" is the only one left.
  8. Select "My-Awesome-Username", and click Edit below.
  9. Make sure the Type: at the top is set to Allow, and then tick the checkbox next to Full control.

  10. Hit OK, Apply, OK, OK.

  11. Give it another try now...

Seems the sometimes the mock-bash can't control the file ownership. It's especially weird, as it's generated from a mock-bash script. Go figure.

user_16827900

None of the workarounds suggested here (chmod/chgrp/setfacl/windows perms) worked for me with msys64 on a Windows 7 corporate VM. In the end I worked around the problem by using an ssh agent with the key provided on stdin. Adding this to my .bash_profile makes it the default for my login:

eval $(ssh-agent -s)
cat ~/.ssh/id_rsa | ssh-add -k -

Now I can do git push and pull with ssh remotes.

user_17630350
Related