How to fix Permissions 0644 for '/home/user/.ssh/id_rsa' are too open. in SSH

SSHBEGINNERHIGHUpdated Jan 4, 2026· 263 views

SSH refuses to use private key files with overly permissive permissions (0644, 0755, etc). Private keys must be restricted to the owner only (mode 600 or 400) for security.

Quick fix

Fixes Permissions 0644 for '/home/user/.ssh/id_rsa' are too open.

ls -la ~/.ssh/id_rsa
  1. Check current permissions on the private key
  2. Restrict private key to owner only using chmod 600
  3. Verify the .ssh directory has correct permissions
  4. Fix all SSH file permissions at once (optional)
ssh — error
ls -la ~/.ssh/id_rsa
Permissions 0644 for '/home/user/.ssh/id_rsa' are too open.

What this error means

SSH enforces strict permission checks on private key files to prevent unauthorized access to your credentials. When a private key file has permissions of 0644 or higher, it means the file is readable by group members and others on the system. Since private keys must remain confidential, OpenSSH rejects such files during authentication. The error occurs because the SSH daemon validates that only the file owner can read the private key—any broader access is considered a security risk and the key is ignored.

Typical symptoms

  • SSH connection fails with 'Permissions X for ... are too open' error
  • Private key is silently ignored even though it exists
  • Authentication fails when using a specific SSH key file
  • Permission denied (publickey) error appears in connection logs

Common causes

  1. Private key file has permissions 0644 (world-readable)
  2. Private key has permissions 0755, 0777, or other overly open modes
  3. Key file was created with umask that set public read permission
  4. Key file copied from another system with different permission defaults
  5. SSH key generated by tool that didn't restrict file permissions

How to fix "Permissions 0644 for '/home/user/.ssh/id_rsa' are too open."

1Check current permissions on the private key

Use ls -la to view the current permissions:

bash
ls -la ~/.ssh/id_rsa

Look for the permission string at the start of the output. Permissions like -rw-r--r-- (0644) or -rwxr-xr-x (0755) are too open.

2Restrict private key to owner only using chmod 600

Use chmod to set permissions to 600 (read and write for owner only):

bash
chmod 600 ~/.ssh/id_rsa

Or for a more restrictive read-only access:

bash
chmod 400 ~/.ssh/id_rsa

Mode 600 allows you to read and modify the key (sometimes needed for key management), while 400 restricts it to read-only.

3Verify the .ssh directory has correct permissions

The .ssh directory itself must have permissions 700 (read, write, execute for owner only):

bash
chmod 700 ~/.ssh

Check the result:

bash
ls -ld ~/.ssh

You should see drwx------ (700 permissions).

4Fix all SSH file permissions at once (optional)

To ensure all files in your .ssh directory have correct permissions:

bash
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys ~/.ssh/known_hosts ~/.ssh/config 2>/dev/null
chmod 600 ~/.ssh/id_rsa ~/.ssh/id_ed25519 2>/dev/null
chmod 644 ~/.ssh/*.pub

This sets:
- 700 for the directory
- 600 for private keys (id_rsa, id_ed25519, etc.)
- 644 for public keys (*.pub files)
- 600 for other sensitive files (authorized_keys, known_hosts, config)

5Retry your SSH connection

After fixing permissions, retry your SSH command:

bash
ssh user@hostname

Or if using a specific key:

bash
ssh -i ~/.ssh/id_rsa user@hostname

The connection should now succeed. If it still fails, check that you're connecting with the correct username and that the public key is in the remote system's authorized_keys file.

Advanced notes

SSH permission checks are platform-specific and strictly enforced on Unix-like systems (Linux, macOS, BSD). On Windows, WSL (Windows Subsystem for Linux) and Git Bash follow the same Unix permission rules. Native Windows SSH clients may be more lenient with permissions but still recommend following these guidelines. The SSH daemon checks both the private key file AND the .ssh directory itself—if either has incorrect ownership or permissions, authentication will fail. Use stat to see detailed permission information: stat ~/.ssh/id_rsa. For shared systems, consider using SSH agent with key passphrases for additional security. If you're copying keys between systems (e.g., CI/CD pipelines), ensure the copy operation preserves or corrects permissions immediately after transfer.

Frequently asked questions

What does "Permissions 0644 for '/home/user/.ssh/id_rsa' are too open." mean?
SSH enforces strict permission checks on private key files to prevent unauthorized access to your credentials. When a private key file has permissions of 0644 or higher, it means the file is readable by group members and others on the system. Since private keys must remain confidential, OpenSSH rejects such files during authentication.
How do I fix "Permissions 0644 for '/home/user/.ssh/id_rsa' are too open."?
SSH refuses to use private key files with overly permissive permissions (0644, 0755, etc). Private keys must be restricted to the owner only (mode 600 or 400) for security.
What causes "Permissions 0644 for '/home/user/.ssh/id_rsa' are too open."?
Private key file has permissions 0644 (world-readable) Private key has permissions 0755, 0777, or other overly open modes Key file was created with umask that set public read permission
Is the "Permissions 0644 for '/home/user/.ssh/id_rsa' are too open." error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading