WARNING: UNPROTECTED PRIVATE KEY FILE!

Printed as a block between `@` lines, followed by "Permissions 0644 for '…' are too open." — the mode and path are those of your file. `ssh-add` prints the same block and refuses to add the key.

OpenSSH client (ssh, ssh-add, scp, git over SSH) — key file permission check

What it means

OpenSSH refuses to use a private key file that other users on the machine could read. The key is ignored ("This private key will be ignored."), so the connection usually continues and then fails with "Permission denied (publickey)". The octal mode in the message shows what the file allows; anything beyond owner read/write (`0600` or `0400`) triggers it, and on Windows the equivalent check uses the file's ACL.

Why it happens

• The key file was created with default permissions

  common

  Keys written by `echo "$SSH_KEY" > key` in CI, extracted from archives, cloned from repositories or downloaded from a secret manager get the umask default (usually 0644).

• Inherited ACLs on Windows

  common

  Windows OpenSSH checks that no other users or groups (like `Users` or `Authenticated Users`) have access. Files in a user profile often inherit broader permissions.

• Bind mounts and network shares

  occasional

  Files mounted from the host into a container, or from SMB/NTFS shares into WSL, can show 0777/0755 modes that cannot be changed in place.

How to fix it

1. 1.

   Restrict the file to its owner

   `chmod 600` (or 400) on the key and 700 on `~/.ssh`. In CI, set the mode in the same step that writes the key.

   chmod 600 ~/.ssh/id_ed25519          # owner read/write only (400 works too)
   chmod 700 ~/.ssh
   ls -l ~/.ssh/id_ed25519               # -rw------- 1 you you ...

2. 2.

   Fix the ACL on Windows

   Remove inheritance and grant read access only to your account.

   REM Windows OpenSSH: remove inherited permissions, grant only your user
   icacls %USERPROFILE%\.ssh\id_ed25519 /inheritance:r
   icacls %USERPROFILE%\.ssh\id_ed25519 /grant:r "%USERNAME%":R

3. 3.

   Mount keys with an explicit mode

   Secrets with `mode: 0400` (or copying the key into the container and `chmod`-ing it) give OpenSSH the permissions it requires.

   # docker compose: mount the key as a secret with explicit mode instead of a bind mount
   services:
     deployer:
       secrets:
         - source: deploy_key
           target: /root/.ssh/id_ed25519
           mode: 0400

← Browse the full signature error database