SSH Private Key Permissions using Git GUI or ssh-keygen are too open

Question

Recently I\'ve been unable to clone or push to github, and I\'m trying to find the root cause.

This is on windows

I have cygwin + git as well as msy

Answer 1

I was able to fix this by doing two things, though you may not have to do step 1.

1. copy from cygwin ssh.exe and all cyg*.dll into Git's bin directory (this may not be necessary but it is a step I took but this alone did not fix things)

2. follow the steps from: http://zylstra.wordpress.com/2008/08/29/overcome-herokus-permission-denied-publickey-problem/

   I added some details to my ~/.ssh/config file:

Host heroku.com
Hostname heroku.com
Port 22
IdentitiesOnly yes
IdentityFile ~/.ssh/id_heroku
TCPKeepAlive yes
User brandon

I had to use User as my email address for heroku.com Note: this means you need to create a key, I followed this to create the key and when it prompts for the name of the key, be sure to specify id_heroku http://help.github.com/win-set-up-git/

1. then add the key:
   heroku keys:add ~/.ssh/id_heroku.pub

Answer 2

I'm playing right now with Git 1.6.5, and I can't replicate your setup:

Administrator@WS2008 /k/git
$ ll ~/.ssh
total 8
drwxr-xr-x    2 Administ Administ     4096 Oct 13 22:04 ./
drwxr-xr-x    6 Administ Administ     4096 Oct  6 21:36 ../
-rw-r--r--    1 Administ Administ        0 Oct 13 22:04 c.txt
-rw-r--r--    1 Administ Administ      403 Sep 30 22:36 config_disabled
-rw-r--r--    1 Administ Administ      887 Aug 30 16:33 id_rsa
-rw-r--r--    1 Administ Administ      226 Aug 30 16:34 id_rsa.pub
-rw-r--r--    1 Administ Administ      843 Aug 30 16:32 id_rsa_putty.ppk
-rw-r--r--    1 Administ Administ      294 Aug 30 16:33 id_rsa_putty.pub
-rw-r--r--    1 Administ Administ     1626 Sep 30 22:49 known_hosts

Administrator@WS2008 /k/git
$ git clone git@github.com:alexandrul/gitbook.git
Initialized empty Git repository in k:/git/gitbook/.git/
remote: Counting objects: 1152, done.
remote: Compressing objects: 100% (625/625), done.
remote: Total 1152 (delta 438), reused 1056 (delta 383)s
Receiving objects: 100% (1152/1152), 1.31 MiB | 78 KiB/s, done.
Resolving deltas: 100% (438/438), done.

Administrator@WS2008 /k/git
$ ssh git@github.com
ERROR: Hi alexandrul! You've successfully authenticated, but GitHub does not pro
vide shell access
Connection to github.com closed.

$ ssh -v
OpenSSH_4.6p1, OpenSSL 0.9.8e 23 Feb 2007

chmod doesn't modify file permissions for my keys either.

Environment:

• Windows Server 2008 SP2 on NTFS
• user: administrator
• environment vars:
  • PLINK_PROTOCOL=ssh
  • HOME=/c/profiles/home

Update: Git 1.6.5.1 works as well.

Answer 3

For Windows 7 using the Git found here (it uses MinGW, not Cygwin):

1. In the windows explorer, right-click your id_rsa file and select Properties
2. Select the Security tab and click Edit...
3. Check the Deny box next to Full Control for all groups EXCEPT Administrators
4. Retry your Git command

Answer 4

Unless there is a reason that you want to keep that private/public key pair (id_rsa/id_rsa.pub), or enjoy banging your head on the wall, I'd recommend just recreating them and updating your public key on github.

Start by making a backup copy of your ~/.ssh directory.

Enter the following and respond "y" to whether you want to over write the existing files.

ssh-keygen -t rsa

Copy the contents of the public key to your clipboard. (Below is how you should do it on a Mac).

cat ~/.ssh/id_rsa.pub | pbcopy

Go to your account on github and add this key.

Name: My new public key
Key: <PASTE>

Exit from your terminal and restart a new one.

If you get senseless error messages like "Enter your password" for your public key when you never entered one, consider this start over technique. As you see above, it's not complicated.

Answer 5

Type on terminal:

chmod -Rf 700 ~/.ssh/

And try again.

Answer 6

After upgrading my Cygwin installation to a version around February 2015 (1.7.34(0.285/5/3) 2015-02-04 12:14 x86_64 Cygwin), I suddenly ran into the UNPROTECTED PRIVATE KEY FILE warning.

I fixed this problem after running the following command:

setfacl -s u::rw-,g::---,o:--- ~/.ssh/id_rsa

(another answer to another question gives more context)