How to fix It is required that your private key files are NOT accessible by others. in SSH

SSHBEGINNERHIGHUpdated Jan 4, 2026· 260 views

SSH enforces strict file permissions to prevent unauthorized access to your private keys. This error occurs when SSH detects that your private key file has permissions that are too permissive (world-readable or group-readable), which could expose your credentials to other users on the system.

Quick fix

Fixes It is required that your private key files are NOT accessible by others.

ls -l ~/.ssh/id_rsa
  1. Check current key permissions
  2. Fix permissions with chmod 600
  3. Fix SSH directory permissions
  4. Fix other SSH file permissions
ssh — error
ls -l ~/.ssh/id_rsa
It is required that your private key files are NOT accessible by others.

What this error means

SSH uses public-key cryptography where your private key must remain secret. If any other user on your system can read your private key file, they could impersonate you and gain unauthorized access to remote servers. SSH performs a security check before attempting authentication: it verifies that only the file owner (you) has read and write permissions, and that no other users or groups can access the key. If the permissions are too open (e.g., 644, 755, or 666), SSH refuses to use the key and displays this error. This is a critical security measure—even well-intentioned file sharing can compromise your accounts.

Typical symptoms

  • SSH connection fails with 'Permissions 0644... are too open' error message
  • Error appears when trying to use SSH key for authentication (command-line, Git, or tools)
  • Manual SSH command shows 'WARNING: UNPROTECTED PRIVATE KEY FILE!'
  • Key works in some contexts but fails in others (usually due to tool-specific checks)
  • Affected SSH tools include OpenSSH, Git, Terraform, AWS CLI, and other applications that use SSH

Common causes

  1. File was created or copied with default permissions (644 or 755) instead of restricted (600)
  2. Umask was set too permissively when generating or copying the key
  3. File permissions were accidentally changed using chmod (e.g., chmod 777, chmod 644)
  4. Key was downloaded from a server and inherited overly permissive permissions
  5. SSH directory or key was created with incorrect file sharing or group permissions
  6. On Windows/WSL: inherited ACLs (Access Control Lists) allowing group or other users to read the file

How to fix "It is required that your private key files are NOT accessible by others."

1Check current key permissions

First, verify what permissions your private key currently has:

bash
ls -l ~/.ssh/id_rsa

Or check all files in your SSH directory:

bash
ls -la ~/.ssh/

Look for your private key file (typically named id_rsa, id_ed25519, id_ecdsa, or a custom name). The permissions will show something like:

- -rw------- 1 user group (600) - CORRECT, only you can read/write
- -rw-r--r-- 1 user group (644) - WRONG, group and others can read
- -rwxrwxrwx 1 user group (777) - WRONG, everyone has full access

If you see anything other than 600 for the private key, proceed to the next step.

2Fix permissions with chmod 600

Set the private key to be readable and writable by only the owner:

bash
chmod 600 ~/.ssh/id_rsa

Replace id_rsa with your actual key filename if it's different (e.g., id_ed25519, github-key).

Verify the fix:

bash
ls -l ~/.ssh/id_rsa

Should now show: -rw------- 1 user user (600 permissions)

3Fix SSH directory permissions

Your .ssh directory must also have restrictive permissions (700):

bash
chmod 700 ~/.ssh

Verify:

bash
ls -ld ~/.ssh

Should show: drwx------ ... user user (700 permissions)

This ensures that only you can list, read, or modify files in your SSH directory.

4Fix other SSH file permissions

While you're at it, set correct permissions for all SSH files:

bash
# Fix public key (readable by anyone, but only writable by you)
chmod 644 ~/.ssh/id_rsa.pub

# Fix authorized_keys (readable/writable only by you)
chmod 600 ~/.ssh/authorized_keys

# Fix known_hosts (readable/writable only by you)
chmod 600 ~/.ssh/known_hosts

# Fix config file if present (readable/writable only by you)
chmod 600 ~/.ssh/config

Summary of correct SSH permissions:
- ~/.ssh directory: 700 (drwx------)
- Private keys (id_rsa, id_ed25519): 600 (-rw-------)
- Public keys (id_rsa.pub): 644 (-rw-r--r--)
- authorized_keys: 600 (-rw-------)
- known_hosts: 600 (-rw-------)
- config: 600 (-rw-------)

5Test SSH authentication

After fixing permissions, test that SSH now works:

bash
ssh -i ~/.ssh/id_rsa user@remote-host.com

Or test with a specific key using verbose mode to debug:

bash
ssh -vvv -i ~/.ssh/id_rsa user@remote-host.com

The verbose output should show:

bash
Trying private key: /home/user/.ssh/id_rsa
...
Authentications that can continue: publickey
...
Authenticated with RSA key

If SSH still fails, the issue is not permissions—check that your public key is in authorized_keys on the remote server.

6Fix permissions for newly generated keys (prevention)

When generating new SSH keys, ensure proper permissions from the start:

bash
# Generate a new key (automatically creates it with 600 permissions)
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 -N ""

# Or with RSA (if you need wider compatibility)
ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa -N ""

The ssh-keygen tool creates private keys with 600 permissions automatically. Just verify:

bash
ls -l ~/.ssh/id_ed25519

Should show -rw------- ... (600).

Advanced notes

Advanced troubleshooting:

Windows PowerShell / ACLs: If using PowerShell or Git Bash on Windows, Unix-style chmod may not fully resolve the issue. Windows uses Access Control Lists (ACLs) instead. You may need to remove inherited permissions:
1. Right-click the key file → Properties → Security tab
2. Click "Advanced" → "Disable inheritance" → "Remove all inherited permissions"
3. Add only your user account with "Full Control"

This mimics Unix mode 600 in Windows.

WSL (Windows Subsystem for Linux): WSL supports Unix permissions, but inherited ACLs from Windows can interfere. If chmod 600 doesn't work:

bash
# Set metadata in WSL to use Unix permissions
chmod 600 ~/.ssh/id_rsa
# Clear WSL permission caches
sudo chown $USER:$USER ~/.ssh/id_rsa

Home Directory Permissions: SSH also checks that your home directory (~) is not world-writable. If ~ has 777 permissions, even with correct key permissions, SSH will reject the key:

bash
# Verify home directory permissions
ls -ld ~

# Should show something like: drwxr-xr-x (755 or 750)
# If you see 777 or drwxrwxrwx, fix it:
chmod 755 ~

SSH Agent Caching: If SSH agent has cached the key with wrong permissions, clear the cache:

bash
ssh-add -D  # Remove all keys from agent
ssh-add ~/.ssh/id_rsa  # Re-add key (may prompt for passphrase)

Custom Key Locations: If your key is in a non-standard location, apply the same rules:

bash
chmod 600 /path/to/custom/key

Ansible / Terraform: Some tools bypass SSH client checks. If Ansible or Terraform still fails after fixing permissions, check the tool's own key permission validation in its logs.

Frequently asked questions

What does "It is required that your private key files are NOT accessible by other" mean?
SSH uses public-key cryptography where your private key must remain secret. If any other user on your system can read your private key file, they could impersonate you and gain unauthorized access to remote servers. SSH performs a security check before attempting authentication: it verifies that only the file owner (you) has read and write permissions, and that no other users or groups can access the key.
How do I fix "It is required that your private key files are NOT accessible by other"?
SSH enforces strict file permissions to prevent unauthorized access to your private keys. This error occurs when SSH detects that your private key file has permissions that are too permissive (world-readable or group-readable), which could expose your credentials to other users on the system.
What causes "It is required that your private key files are NOT accessible by other"?
File was created or copied with default permissions (644 or 755) instead of restricted (600) Umask was set too permissively when generating or copying the key File permissions were accidentally changed using chmod (e.g., chmod 777, chmod 644)
Is the "It is required that your private key files are NOT accessible by other" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading