SSH Key Permissions: The Correct chmod Values

Secure Shell (SSH) is the global backbone of remote server administration, automated CI/CD code deployments, and cryptographic network communication. Because SSH keys bypass passwords in favor of asymmetric cryptographic authentication, OpenSSH incorporates aggressive, fail-closed security checks to protect your key material. If any file within your SSH configuration directory is too permissive, the SSH client refuses to transmit authentication packets and immediately drops your connection. Configuring the correct octal permissions across your ~/.ssh directory structure—from chmod 700 down to chmod 600 and chmod 400—is essential for seamless server management.

~/.ssh 700

The root of all SSH client and server configurations on a Unix system resides within the ~/.ssh directory inside your user home folder. Because this folder stores private keys, public keys, known host fingerprints, and authorized server logins, the directory itself must be completely hidden from all other users on the operating system:

# Set correct permissions on the .ssh directory
chmod 700 ~/.ssh

# Verify the mode with stat
stat -c '%a %A %n' ~/.ssh   # Linux: 700 drwx------ /home/user/.ssh
stat -f '%Lp %Sp %N' ~/.ssh # macOS: 700 drwx------ /Users/user/.ssh

Configuring chmod 700 grants the owner read, write, and execute permissions (drwx------) while assigning absolute zero access to group members and the public. This guarantees that unprivileged local users or compromised service accounts cannot list the files inside your ~/.ssh directory, read your known hosts, or tamper with your connection parameters.

Private Key 600

Your SSH private key (such as ~/.ssh/id_ed25519 or ~/.ssh/id_rsa) is the cryptographic secret that proves your identity to remote servers. Under no circumstances should any user or process other than your primary account possess access to this file:

# Enforce owner-only read and write on all private keys
chmod 600 ~/.ssh/id_ed25519
chmod 600 ~/.ssh/id_rsa

# Verify with ls -l
$ ls -l ~/.ssh/id_ed25519
-rw------- 1 developer developer 411 Jan 15 10:00 /home/developer/.ssh/id_ed25519

Mode chmod 600 provides read and write capabilities exclusively to the owner (-rw-------). Setting private keys to looser modes like chmod 644 or chmod 664 allows other local users to read your key text, completely invalidating the security perimeter of every remote host you manage.

Public Key 644

Your SSH public key (such as ~/.ssh/id_ed25519.pub or ~/.ssh/id_rsa.pub) contains the public mathematical component paired with your private key. Unlike the private key, your public key is designed to be shared openly with remote servers, GitHub repositories, and server administrators:

# Set standard file permissions on public keys
chmod 644 ~/.ssh/id_ed25519.pub
chmod 644 ~/.ssh/id_rsa.pub

# Public keys show rw-r--r--
$ ls -l ~/.ssh/*.pub
-rw-r--r-- 1 developer developer 98 Jan 15 10:00 /home/developer/.ssh/id_ed25519.pub

Using chmod 644 allows the file owner to update or regenerate the key while permitting local utilities and diagnostic scripts to read the string when configuring automated deployment pipelines. Because the public key contains no secret data, world readability carries zero security risk.

authorized_keys 600

On remote Linux servers, the ~/.ssh/authorized_keys file holds the public keys of all users permitted to log in to that account without entering a password. If an unauthorized actor can write to this file, they can inject their own public key and grant themselves persistent administrative access to your server:

# Lock down authorized_keys on the server
chmod 600 ~/.ssh/authorized_keys

# Also ensure config and known_hosts files are protected
chmod 644 ~/.ssh/known_hosts
chmod 600 ~/.ssh/config

OpenSSH server configurations (governed by StrictModes yes in /etc/ssh/sshd_config) explicitly check the permissions of ~/.ssh/authorized_keys on every incoming connection. If authorized_keys has group or world write access (as in chmod 664 or chmod 666), the SSH daemon rejects key authentication, falling back to password prompts or terminating the connection.

"Unprotected Private Key File" Error

If you have ever encountered the following alarming terminal warning, your private key has triggered an OpenSSH safety abort:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/home/developer/.ssh/id_rsa' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "/home/developer/.ssh/id_rsa": bad permissions
[email protected]: Permission denied (publickey).

This message occurs because OpenSSH detected that group members or others can read the private key. To fix this error in one step, reset the file mode to chmod 600:

# Immediate fix for the OpenSSH warning
chmod 600 ~/.ssh/id_rsa

AWS .pem 400

When provisioning cloud instances on Amazon Web Services (AWS EC2), your downloaded key pair arrives as a .pem file. AWS documentation and the AWS CLI strictly mandate that your private key file be set to chmod 400:

# AWS EC2 key pair security requirement
chmod 400 my-key-pair.pem

# Connect securely to your EC2 instance
ssh -i my-key-pair.pem [email protected]

Mode chmod 400 provides read-only access to the file owner (-r--------), stripping even the owner write privileges. This additional layer of defense guards against accidental key truncation, script overwrites, and unintended file deletion. If you ever need to edit or reformat an AWS key file, temporarily grant write access with chmod u+w my-key-pair.pem, make your modifications, and return it to 400 immediately.

Frequently Asked Questions