How to fix @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ in SSH

First, verify what permissions your private key currently has:

ls -la ~/.ssh/id_rsa

Or for Ed25519 keys:

ls -la ~/.ssh/id_ed25519

Look at the leftmost characters. You'll see something like:
- -rw------- (600) — Correct, key is only readable by you
- -r-------- (400) — Also correct, key is read-only by you
- -rw-r--r-- (644) — Too open! Readable by group and others (WRONG)
- -rwxr-xr-x (755) — Much too open (WRONG)

If you see 644, 755, or any permissions beyond 600/400, you need to fix them.

Use chmod to set the correct permissions. The most common fix is 600 (readable and writable by owner only):

chmod 600 ~/.ssh/id_rsa

Or for Ed25519 keys:

chmod 600 ~/.ssh/id_ed25519

Or for any other private key by path:

chmod 600 /path/to/private-key

Alternatively, you can use 400 (read-only) instead of 600:

chmod 400 ~/.ssh/id_rsa

Both 600 and 400 are acceptable. The difference is whether you want to allow yourself to write to the key file (600) or make it read-only (400).

Verify the fix worked:

ls -la ~/.ssh/id_rsa

Output should show -rw------- or -r--------.

The ~/.ssh directory itself also needs correct permissions. Set it to 700 (accessible only by you):

chmod 700 ~/.ssh

Check it:

ls -ld ~/.ssh

Should show: drwx------ (700).

This is critical because if others can write to ~/.ssh, they could potentially modify your authorized_keys file or other sensitive files.

While you're at it, ensure other SSH files have correct permissions:

# Public keys should be readable (644)
chmod 644 ~/.ssh/id_rsa.pub
chmod 644 ~/.ssh/id_ed25519.pub

# authorized_keys should be readable only by you (600)
chmod 600 ~/.ssh/authorized_keys

# known_hosts should be readable only by you (600)
chmod 600 ~/.ssh/known_hosts

# config file should be readable only by you (600)
chmod 600 ~/.ssh/config

Check everything at once:

ls -la ~/.ssh/

Expected output:

drwx------  2 user group 4096 Jan  4 10:00 .
-rw-------  1 user group 3243 Jan  4 10:00 id_rsa
-rw-r--r--  1 user group  743 Jan  4 10:00 id_rsa.pub
-rw-------  1 user group 2048 Jan  4 10:00 authorized_keys
-rw-------  1 user group 1024 Jan  4 10:00 known_hosts

After fixing permissions, test your SSH connection:

ssh user@remote-host

Or with verbose output to see which key is being used:

ssh -v user@remote-host

You should see output like:

Trying private key: /home/user/.ssh/id_rsa
...
Authentications that can continue: publickey
Offering public key: /home/user/.ssh/id_rsa RSA SHA256:...
Authentication succeeded (publickey).

The "UNPROTECTED PRIVATE KEY FILE" warning should be gone, and authentication should work without falling back to password prompts.

If your private key is in a custom location (e.g., AWS .pem files, GitHub deploy keys):

# Fix the specific key file
chmod 600 /path/to/your/custom-key.pem

# Or if it's in a custom directory, fix that too
chmod 700 /path/to/custom/.ssh-like-directory

When using such keys with SSH, explicitly specify them:

ssh -i /path/to/custom-key.pem user@remote-host

Or add to your ~/.ssh/config:

Host my-custom-host
  User ec2-user
  IdentityFile /path/to/custom-key.pem